Spoutible spoutible.com Spoutible data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In January 2024, a misconfigured API on the social platform Spoutible returned excessive personal data for 207,114 accounts, per Have I Been Pwned. It included names, emails, phone numbers, IP addresses, bcrypt password hashes, 2FA secrets and backup codes.
View all 13,118 breaches- Breach date
- 31 Jan 2024
- Affected
- 207,114
- Data exposed
- Email addresses, Genders, IP addresses, Names, Passwords, Phone numbers, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In January 2024, Spoutible had records scraped from a misconfigured API, a programming interface that returned far more personal information than it should have. Have I Been Pwned (HIBP) lists 207,114 accounts and added them on 5 February 2024. Troy Hunt, who runs HIBP, wrote up the incident in How Spoutible's leaky API spurted out a deluge of personal data.
Sources checked: haveibeenpwned.com, troyhunt.com, helpnetsecurity.com
Last verified against the official page:
What was exposed
HIBP lists names, usernames, email addresses, IP addresses, phone numbers (where provided), genders and bcrypt password hashes. The incident also exposed 2FA secrets and backup codes, along with password reset tokens.
What it means for you
The 2FA secret is the seed an authenticator app uses to generate login codes, so anyone holding it can produce valid codes. That is why two-factor login needs resetting here, not only the password. Names, emails and phone numbers also make phishing and scam texts more convincing.
The company's response
Spoutible said that decrypted passwords and direct messages were not disclosed, according to Help Net Security. Per the same reporting, the development team changed the API to return only non-sensitive user data.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you used your Spoutible password on any other account, change it there now, and use a different password for each account. A password manager makes that easy.
- 2
Reset your two-factor login
Turn off two-factor login on Spoutible and set it up again so you get a new secret and new backup codes. The old ones were exposed.
- 3
Review linked accounts
If you linked Spoutible to other services, such as cross-posting to Mastodon or Bluesky, revoke those connections and reconnect them. Troy Hunt advised invalidating those keys as a precaution.
- 4
Expect scam messages
With your name, email and phone number out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 5
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the Spoutible breach?
Check your email on Have I Been Pwned. If Spoutible is listed, you were among the 207,114 accounts.
What was exposed in the Spoutible breach?
Names, usernames, emails, IP addresses, phone numbers, genders, bcrypt password hashes, 2FA secrets and backup codes, and password reset tokens, per HIBP.
Should I change my password?
Yes. Change it on Spoutible and anywhere you reused it, and reset your two-factor setup too.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
