Gemplex gemplex.tv Gemplex data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In February 2021, the Indian streaming platform Gemplex was breached. Have I Been Pwned lists 4,563,166 user accounts, with names, email addresses, phone numbers, device information and bcrypt password hashes exposed. It was added in December 2023.
View all 13,118 breaches- Breach date
- 18 Feb 2021
- Affected
- 4,563,166
- Data exposed
- Device information, Email addresses, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Gemplex is an Indian streaming platform. In February 2021 it suffered a data breach. Have I Been Pwned (HIBP) lists 4,563,166 user accounts and added them on 9 December 2023. HIBP describes the exposure as 4.6 million accounts.
Sources checked: haveibeenpwned.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
According to HIBP, the data included names, email addresses, phone numbers, device information and passwords stored as bcrypt hashes. Bcrypt is a slow, purpose-built way to store passwords, which makes mass cracking harder than with older hashes, though weak passwords can still be guessed.
What it means for you
A name, an email and a phone number together are what scammers use to make phishing emails and scam texts look personal. Device information can be used to make a message sound like it knows your phone. Your phone number is also the detail that matters for SIM swap fraud, where a criminal tries to take over your number by impersonating you to your carrier.
The company's response
HIBP's entry links no company notice, so it is the public record of the breach. You can check your own email or phone on HIBP for free.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you used your Gemplex password on any other account, change it there now, and use a different password for each account. A password manager makes that easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your important accounts, starting with email. It blocks most takeovers even when a password has leaked. The FTC lists this among its post-breach steps.
- 3
Expect scam messages
With your name, email and phone number out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 4
Add a PIN to your phone account
Ask your mobile carrier about a PIN or port-out lock, so a criminal can't move your number to another SIM by calling in. Check your carrier's own instructions for how.
- 5
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the Gemplex breach?
Search your email or phone number on Have I Been Pwned. If Gemplex appears, you were among the 4,563,166 accounts.
What was exposed in the Gemplex breach?
Device information, names, phone numbers, email addresses and bcrypt password hashes, per HIBP.
Should I change my password?
Yes, if you reused it anywhere. Bcrypt hashing makes cracking slower, not impossible.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
