OpenSubtitles opensubtitles.org Open Subtitles data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In August 2021 the subtitle site Open Subtitles was breached and hit with a ransom demand. Have I Been Pwned counts 6,783,158 accounts: email and IP addresses, usernames, countries and passwords stored as unsalted MD5 hashes.
View all 13,118 breaches- Breach date
- Aug 2021
- Affected
- 6,783,158
- Data exposed
- Email addresses, Geographic locations, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
According to Have I Been Pwned, the subtitling website Open Subtitles suffered a data breach in August 2021, followed by a ransom demand. The breach exposed 6,783,158 subscribers' personal data. It was added on 19 January 2022.
Reports based on the site owner's notice say an attacker contacted the site, showed proof of access to the user table and demanded a ransom in bitcoin. The operators reportedly paid, mainly because the amount was small, but the data was later leaked anyway. The owner said the attacker got in through a SuperAdmin account with a weak password and a script that allowed SQL injection.
Sources checked: haveibeenpwned.com, therecord.media, bankinfosecurity.com
Last verified against the official page:
What was exposed
Email addresses, IP addresses, usernames, the user's country and passwords stored as unsalted MD5 hashes. Reports say subscribers' financial data was not compromised.
What it means for you
Email plus IP address and country lets scammers write believable messages and guess where you are. Unsalted MD5 hashes are easy to crack, so any common or reused password should be treated as exposed. Paying a ransom didn't stop the leak, which is a reminder that you can't count on data staying private after a breach.
What to do if you were in it
- 1
Change your password, and any reuse of it
Change your Open Subtitles password, then change it on every other account where you used the same or a similar one. Use a password manager so each account gets a unique password, and turn on two-factor login where it's offered.
- 2
Expect phishing that mentions the breach
Scammers use leaked email addresseses to send convincing messages. Don't click links in unexpected emails or texts about your account, and go to the site directly instead.
- 3
Use a different username on important accounts
Usernames were exposed. If you use the same username and email combination on accounts that matter, a leaked pair is easier for attackers to target.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Open Subtitles breach?
If you had an account in August 2021, your email may be one of 6,783,158 in the data. Check it on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, IP addresses, usernames, countries and passwords stored as unsalted MD5 hashes.
Was there a ransom?
Have I Been Pwned describes a subsequent ransom demand. Reports say the operators paid and the data leaked anyway.
Sources
- Have I Been Pwned: OpenSubtitles
- Have I Been Pwned: Open Subtitles Data Breach · haveibeenpwned.com
- OpenSubtitles discloses successful extortion attempt, data breach · therecord.media
- OpenSubtitles Data Breach Affected 6.7 Million Users · bankinfosecurity.com
Something wrong or out of date? Tell us and we'll re-check it.
