Swvl swvl.com Swvl data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In June 2020 the Egyptian bus operator Swvl was breached, exposing over 4 million members. The data included names, emails, phone numbers, profile photos, the last 4 digits of cards and bcrypt-hashed passwords.
View all 13,118 breaches- Breach date
- 23 Jun 2020
- Affected
- 4,195,918
- Data exposed
- Email addresses, Names, Partial credit card data, Passwords, Phone numbers, Profile photos
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Swvl runs app-booked buses in Egypt and other countries. In July 2020 it said it had noticed unauthorised access on the evening of 3 July, and logged all users out as a precaution. Have I Been Pwned dates the breach to June 2020 and counts 4,195,918 exposed accounts.
Swvl's statement named names, email addresses and phone numbers and said passwords and card details weren't affected. Have I Been Pwned's analysis of the data found more: profile photos, partial card data and passwords.
Sources checked: haveibeenpwned.com, dawn.com, portswigger.net
Last verified against the official page:
What was exposed
Have I Been Pwned lists email addresses, names, partial credit card data (card type and last 4 digits), passwords, phone numbers and profile photos. The passwords were stored as bcrypt hashes, a slow hashing method that makes guessing hard but not impossible for weak passwords.
The last 4 digits of a card aren't enough to make a payment. They can make a phishing message look believable, though, especially next to your name and phone number.
What it means for you
Expect smishing and phone scams that use your real name. If you reused your Swvl password, change it everywhere.
The data was shared widely and can't be recalled. Changing passwords and watching for scams is what helps.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on Swvl, then change it on any other account that used the same or a similar one. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey wherever the site offers it. It blocks most account takeovers even when an old password is out there.
- 3
Expect phishing that uses these details
Criminals can use leaked names, emails and phone numbers to write messages that look personal. Don't click links in unexpected emails or texts. Go to the company's site yourself.
- 4
Watch for messages that mention your card
A message that quotes the last 4 digits of your card isn't proof it's from your bank. Call the number on the back of your card instead of replying.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone number and other details and alerts you when they show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Swvl breach?
If you had a Swvl account in mid-2020, check your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Names, email addresses, phone numbers, profile photos, partial card data (type and last 4 digits) and bcrypt-hashed passwords.
Did Swvl say passwords were exposed?
Swvl said passwords and card details weren't affected. Have I Been Pwned's entry for the data lists passwords and partial card data, so treat them as exposed.
Should I change my password?
Yes, and change it anywhere you reused it.
Sources
- Have I Been Pwned: Swvl
- Have I Been Pwned: Swvl Data Breach · haveibeenpwned.com
- dawn.com/news/amp/1572237
- PortSwigger — Web security tools, training and research · portswigger.net
Something wrong or out of date? Tell us and we'll re-check it.
