Fantasy Football Hub fantasyfootballhub.co.uk Fantasy Football Hub data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In October 2021 the fantasy Premier League site Fantasy Football Hub was breached, exposing 66,479 email addresses with names, usernames, IP addresses, purchases and passwords stored as WordPress MD5 hashes. HIBP added it on 7 October 2021.
View all 13,118 breaches- Breach date
- 2 Oct 2021
- Affected
- 66,479
- Data exposed
- Email addresses, IP addresses, Names, Passwords, Purchases, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Fantasy Football Hub is a fantasy Premier League (soccer) site. According to Have I Been Pwned, it suffered a data breach in October 2021 that exposed 66,479 unique email addresses. The site posted its own notice, titled "we have suffered a cyber attack", and the data was added to Have I Been Pwned on 7 October 2021.
Sources checked: haveibeenpwned.com, fantasyfootballhub.co.uk
Last verified against the official page:
What was exposed
The data included email addresses, names, usernames, IP addresses, purchases and passwords. The passwords were stored as WordPress MD5 hashes, a weak format that is easy to crack for common passwords.
What it means for you
Email addresses and names support phishing that mentions fantasy football or the site. Purchase records tell a scammer what you bought, which helps them fake a receipt or refund message. The site's notice told users about the attack, so a message that matches it is plausible, but one asking you to log in through a link is not. The bigger risk is password reuse: if you used the same password on other accounts, someone who cracks the hash can try it elsewhere. Common passwords fall to cracking tools in seconds, so treat yours as known if it was simple.
What to do if you were in it
- 1
Change your password, and any reuse of it
Change your Fantasy Football Hub password, then change it on every other account where you used the same or a similar one. Use a password manager so each account gets a unique password, and turn on two-factor login where it's offered.
- 2
Expect phishing that mentions the breach
Scammers use leaked email addresses and purchase detailses to send convincing messages. Don't click links in unexpected emails or texts about your account, and go to the site directly instead.
- 3
Watch your card statements
The data lists purchases. Check recent card statements for charges you don't recognise and ignore messages about refunds or failed payments that arrive out of the blue.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Fantasy Football Hub breach?
If you had an account in October 2021, your email may be one of the 66,479 in the data. Check it on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, usernames, IP addresses, purchases and passwords stored as WordPress MD5 hashes.
Should I change my password?
Yes, and change it on any other account that used the same password.
Sources
- Have I Been Pwned: FantasyFootballHub
- Have I Been Pwned: Fantasy Football Hub Data Breach · haveibeenpwned.com
- User Data Breach · fantasyfootballhub.co.uk
Something wrong or out of date? Tell us and we'll re-check it.
