SitePoint sitepoint.com SitePoint data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
SitePoint, a web development site, was breached in June 2020. Over 1 million accounts were exposed, including email and IP addresses, names, usernames, bios and bcrypt-hashed passwords. It became public in early 2021.
View all 13,118 breaches- Breach date
- 20 Jun 2020
- Affected
- 1,021,790
- Data exposed
- Bios, Email addresses, IP addresses, Names, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
The web development site SitePoint had its user database stolen in June 2020, according to Have I Been Pwned (HIBP). The data covers 1,021,790 accounts. It stayed out of public view for months: BleepingComputer reported in February 2021 that the database had been put up for sale on a hacking forum and that it had first heard about the sale in December 2020.
SitePoint confirmed the breach after users reported extortion emails and fake cryptocurrency giveaway messages sent to addresses they had used only for SitePoint. The company said the intruder got in through a third-party tool it used to monitor its GitHub account. It removed the tool and rotated its API keys. SecurityWeek reported that SitePoint said it holds no payment card data, so no financial information was involved.
What was exposed
HIBP lists email addresses, IP addresses, names, usernames, bios and passwords. The passwords were stored as bcrypt hashes. Bcrypt is a slow hashing method built to make guessing expensive, so strong, unique passwords are unlikely to have been cracked quickly. Short or common ones are a different story.
What that lets criminals do
An email address plus a real name is enough to run convincing phishing, and the extortion emails SitePoint users received show the list was used that way. The IP address gives a rough location. If you reused your SitePoint password on another site, anyone who cracked the hash could try it there, which is called credential stuffing.
What to do now
Change your SitePoint password, and the password on any account where you reused it. Turn on two-factor authentication where it's offered. Treat any email that mentions SitePoint, a crypto giveaway or a threat to expose you as a scam.
Sources checked: haveibeenpwned.com, bleepingcomputer.com, securityweek.com
Last verified against the official page:
What to do if you were in it
- 1
Change your SitePoint password and any reused one
Pick a long, unique password for each account. A password manager makes that practical. The FTC and CISA both recommend long, unique passwords: FTC password guidance, CISA on strong passwords.
- 2
Turn on two-factor authentication
Where a site offers it, enable multi-factor authentication so a stolen password alone isn't enough. See CISA's guide to MFA.
- 3
Ignore extortion and giveaway emails
Messages threatening to expose you, or promising free crypto, are scams. Don't reply or pay. The FTC explains how to spot them: how to recognize phishing.
- 4
Check whether your email or phone is in this and other breaches
Serus runs a free scan of your email and phone number against breach databases and the dark web. If something turns up, it alerts you and tells you what to do next. Serus can't remove data that has already leaked, but it can tell you which of your accounts are exposed. Run a free scan.
Frequently asked
Was I affected by the SitePoint data breach?
If you had a SitePoint account around June 2020, your email address may be among the 1,021,790 accounts HIBP lists. You can search your email on HIBP, or run a free Serus scan.
What data was exposed in the SitePoint breach?
Email addresses, IP addresses, names, usernames, bios and passwords stored as bcrypt hashes, according to HIBP.
Were credit card details exposed?
SecurityWeek reported that SitePoint said it doesn't store credit card data, so no financial information was accessed.
Should I change my password?
Yes, on SitePoint and on any site where you used the same password. Then turn on two-factor authentication where you can.
Sources
- Have I Been Pwned: SitePoint
- Have I Been Pwned: SitePoint Data Breach · haveibeenpwned.com
- bleepingcomputer.com/news/security/sitepoint-discloses-data-breach-after-stolen-info-used-in-attacks/
- securityweek.com/web-developer-hub-sitepoint-discloses-data-breach
- consumer.ftc.gov/articles/how-keep-your-personal-information-secure
- Use Strong Passwords · cisa.gov
- Turn On MFA | CISA · cisa.gov
- How To Recognize and Avoid Phishing Scams · consumer.ftc.gov
Something wrong or out of date? Tell us and we'll re-check it.
