Havenly havenly.com Havenly data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In June 2020 the interior design site Havenly was breached, exposing almost 1.4 million members. The data included email addresses, names, phone numbers, locations and hashed passwords. Havenly logged users out and required password resets.
View all 13,118 breaches- Breach date
- 25 Jun 2020
- Affected
- 1,369,180
- Data exposed
- Email addresses, Geographic locations, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Havenly is an online interior design service. In late July 2020 its user records appeared online as part of a release of data from several companies. Have I Been Pwned dates the breach to 25 June 2020 and counts 1,369,180 exposed accounts.
Havenly was slow to say anything publicly. It later posted a notice about a potential incident affecting customer accounts, logged all existing customers out and required password resets. It said it doesn't store full credit card numbers.
Sources checked: haveibeenpwned.com, securityaffairs.com, infosecurity-magazine.com
Last verified against the official page:
What was exposed
Have I Been Pwned lists email addresses, geographic locations, names, passwords and phone numbers. Passwords were stored as SHA-1 hashes according to Have I Been Pwned, a fast, older method that makes weak passwords easy to crack.
What it means for you
The biggest risk is a reused password, since SHA-1 hashes of common passwords are cracked quickly. Your name, phone number and location also make scam texts and calls more believable, especially anything about home or design projects.
The data can't be recalled. New passwords and caution with unexpected messages are what protect you.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on Havenly, then change it on any other account that used the same or a similar one. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey wherever the site offers it. It blocks most account takeovers even when an old password is out there.
- 3
Expect phishing that uses these details
Criminals can use leaked names, emails, phone numbers and locations to write messages that look personal. Don't click links in unexpected emails or texts. Go to the company's site yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone number and other details and alerts you when they show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Havenly breach?
If you had a Havenly account in 2020, possibly. Check your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, geographic locations, names, phone numbers and SHA-1 hashed passwords.
Were my card details exposed?
Havenly said it doesn't store full credit card numbers, and card data isn't among the types Have I Been Pwned lists.
Should I change my password?
Yes, on Havenly and anywhere you reused it.
Sources
- Have I Been Pwned: Havenly
- Have I Been Pwned: Havenly Data Breach · haveibeenpwned.com
- Havenly discloses data breach, 1.3M accounts available online · securityaffairs.com
- Havenly Breach Hits Over 1.3 Million Accounts · infosecurity-magazine.com
Something wrong or out of date? Tell us and we'll re-check it.
