Peatix peatix.com Peatix data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Peatix, an event organizing platform, was breached in January 2019 per Have I Been Pwned. The data covers 4.2 million email addresses, names and salted password hashes, and it was added to the database on 6 December 2020.
View all 13,118 breaches- Breach date
- 20 Jan 2019
- Affected
- 4,227,907
- Data exposed
- Email addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Have I Been Pwned dates the Peatix breach to January 2019 and added it on 6 December 2020. It exposed 4.2 million email addresses, names and salted password hashes.
The data became public in November 2020. News reports at the time said a hacker advertised the user data on Instagram stories, Telegram channels and hacking forums. Peatix said it learned on 9 November that user account data had been improperly accessed. It said it found the point of entry, blocked the intruders, and emailed affected users to ask them to change their passwords.
Sources checked: haveibeenpwned.com, infosecurity-magazine.com, threatpost.com
Last verified against the official page:
What was exposed
Besides emails, names and salted password hashes, Peatix's own notice listed usernames, nicknames, preferred languages, countries and time zones. A salted hash is a scrambled password with extra random data added so identical passwords don't produce identical hashes. It makes mass cracking slower. It doesn't protect weak passwords.
What it lets criminals do
Peatix warned of follow-on credential stuffing and password spraying. That means trying leaked passwords, or common ones, against other sites. If you reused your Peatix password, that's the main risk. The names and emails also feed phishing, including fake event tickets and booking messages that look like they come from an organizer.
What to do
Change your Peatix password and any account that shares it. Be careful with unexpected messages about events or tickets.
What to do if you were in it
- 1
Change your Peatix password
Pick a new, unique one in a password manager. Then change it anywhere you used the same or a similar password.
- 2
Turn on two-factor login
Enable it on your email and on any account that holds money or personal details.
- 3
Be careful with event and ticket emails
Phishing may pose as an event organizer or a refund. Open the Peatix site or app yourself rather than clicking a link.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number and shows which leaks they appear in.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Peatix data breach?
The data covers 4.2 million email addresses. Check your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Peatix breach?
Email addresses, names and salted password hashes. Peatix's notice also listed usernames, nicknames, languages, countries and time zones.
When did the Peatix breach happen?
Have I Been Pwned dates it to January 2019. Peatix said it learned of the access on 9 November 2020, after the data was leaked.
Should I change my password?
Yes. Change your Peatix password and any other account that uses the same one.
Sources
- Have I Been Pwned: Peatix
- Have I Been Pwned: Peatix Data Breach · haveibeenpwned.com
- Peatix Braces Users for Follow-On Attacks After Breach · infosecurity-magazine.com
- Post Breach, Peatix Data Reportedly Found on Instagram, Telegram · threatpost.com
Something wrong or out of date? Tell us and we'll re-check it.
