JD jd.com JD data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
JD, the Chinese e-commerce company, had user data stolen in 2013 (exact date unknown). Have I Been Pwned lists 77,449,341 accounts with email addresses, usernames, phone numbers and passwords stored as SHA-1 hashes.
View all 13,118 breaches- Breach date
- Jan 2013
- Affected
- 77,449,341
- Data exposed
- Email addresses, Passwords, Phone numbers, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
JD is one of China's largest online retailers. Its data was stolen in 2013, although the exact date isn't known, and it only came to wide attention years later when the data was reported to be traded online. In December 2016, JD apologised publicly for a user data leak, said it happened in 2013 and blamed a flaw in Apache Struts 2, an open-source web framework. The company said it closed the holes and told users to update their accounts. Have I Been Pwned (HIBP) added the data to its database in June 2021.
HIBP lists 77,449,341 accounts, from 13GB of data holding 77 million unique email addresses.
Sources checked: haveibeenpwned.com, technode.com
Last verified against the official page:
What was exposed
HIBP says the data included email addresses, usernames, phone numbers and passwords stored as SHA-1 hashes. SHA-1 is fast to crack, so weak passwords are easy to recover from it. JD's own apology mentioned other fields too, such as ID numbers, so treat your account as exposed in more ways than the HIBP list shows.
What it lets criminals do
The data is old, but people keep their email addresses and phone numbers for decades. Cracked passwords are tried on other sites, and a phone number with a username makes SMS scams more convincing.
What to do
If you used JD around 2013, work through the steps below.
What to do if you were in it
- 1
Change your JD password, and any you reused it on
Pick a new, unique password on the affected site, then change it everywhere you used the same or a similar one. A password manager makes unique passwords easy to keep.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email, banking and shopping accounts. It stops most account takeovers even when a password is already out there.
- 3
Expect phishing that mentions the breach
With your email and phone number out, scammers can write emails and texts that look personal. Don't click links in unexpected messages. Go to the company's site yourself.
- 4
Check accounts where you used the same password
Passwords from 2013 are long gone from most people's lives, but reused ones can still be live. Search your password manager for repeats of anything you used on JD.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number, and Serus keeps monitoring and alerts you when your details turn up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the JD breach?
If you had an account with JD around 2013, you may be. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, usernames, phone numbers and passwords stored as SHA-1 hashes, per HIBP.
Why does an old breach still matter?
Emails and phone numbers rarely change, and old passwords are often reused. Both can still be tried on your current accounts.
Should I change my password?
Yes, on JD and on anywhere you reused the password.
Sources
- Have I Been Pwned: JD
- Have I Been Pwned: JD Data Breach · haveibeenpwned.com
- Ecommerce Giant JD Apologizes for Leak Exposing User Data · technode.com
Something wrong or out of date? Tell us and we'll re-check it.
