ShopBack shopback.com ShopBack data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In September 2020, cashback site ShopBack had customer data exposed. Have I Been Pwned lists 20,529,819 accounts with email addresses, names, phone numbers, locations and salted SHA-1 password hashes. ShopBack told customers to reset passwords.
View all 13,118 breaches- Breach date
- 17 Sept 2020
- Affected
- 20,529,819
- Data exposed
- Email addresses, Geographic locations, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
ShopBack runs a cashback and rewards program across several countries in Asia and Australia. Reports from September 2020 say the company learned of unauthorised access to systems holding customer data, started an investigation with outside security specialists and removed the access. It told customers on 25 September 2020 to reset their passwords, and said it doesn't store 16-digit card numbers or CVV codes. The Personal Data Protection Commission in Singapore was notified.
Have I Been Pwned (HIBP) lists 20,529,819 accounts, covering over 20 million unique email addresses.
Sources checked: haveibeenpwned.com, soyacincau.com, thejakartapost.com
Last verified against the official page:
What was exposed
The data included email addresses, names, phone numbers, country of residence and passwords stored as salted SHA-1 hashes. SHA-1 is an old, fast hashing method, so weak or common passwords can be cracked from it quickly. HIBP says the data was provided by a third party.
What it lets criminals do
Passwords that get cracked get tried on other sites, because many people reuse them. Phone numbers and emails also feed smishing and phishing, and a message that mentions cashback or a shopping reward looks natural coming from someone who knows you use ShopBack.
What to do
Change the password first. Then look at the places you reused it.
What to do if you were in it
- 1
Change your ShopBack password, and any you reused it on
Pick a new, unique password on the affected site, then change it everywhere you used the same or a similar one. A password manager makes unique passwords easy to keep.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email, banking and shopping accounts. It stops most account takeovers even when a password is already out there.
- 3
Expect phishing that mentions the breach
With your email and phone number out, scammers can write emails and texts that look personal. Don't click links in unexpected messages. Go to the company's site yourself.
- 4
Check for cashback and account scams
Don't click links in messages about missing cashback or a locked account. Open the ShopBack app or type the address yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number, and Serus keeps monitoring and alerts you when your details turn up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the ShopBack breach?
If you had a ShopBack account in 2020, assume so. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, phone numbers, geographic locations and passwords stored as salted SHA-1 hashes, according to HIBP.
Were my card details exposed?
ShopBack said it doesn't store full card numbers or CVV codes, and HIBP doesn't list card data for this breach.
Should I change my password?
Yes, here and anywhere you used the same password. ShopBack told customers to reset passwords.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
