ActMobile Data Breach (2021): What Was Exposed & What To Do

In October 2021, security researcher Bob Diachenko reported an exposed database that he attributed to ActMobile, the company behind the Dash VPN and FreeVPN services. The dataset contained 1.6 million unique email addresses, associated IP addresses, and password hashes, and it later appeared on a hacking forum. Have I Been Pwned subscribers confirmed that some of the email addresses corresponded to accounts on the services, yet ActMobile stated that the material did not originate from its systems, and the incident remains classified as unverified.

Inside the incident

The discovery was made public on 8 October 2021. Diachenko described an openly accessible database whose contents matched records expected from a VPN operator. The material was subsequently posted to a forum commonly used to share stolen data. No official statement from ActMobile has confirmed the source or the circumstances of the exposure, and the company has explicitly denied that the records came from its infrastructure.

How a breach like this happens

Exposures of this kind often trace to misconfigured storage systems that are left reachable from the public internet. In such cases an attacker or researcher can locate the data through automated scanning without needing to bypass authentication. Once found, the contents can be copied and later redistributed on forums or marketplaces. The precise sequence that led to the ActMobile dataset becoming accessible has not been established in public reporting.

ActMobile and its sector

ActMobile operates consumer VPN products that route user traffic through its servers. Companies in this sector routinely collect email addresses for account creation and IP addresses to manage connections and enforce usage limits. A dataset tied to these services therefore contains identifiers that link individuals to their network activity over time.

The information in question

The reported records include email addresses, IP addresses, and password hashes. Public statements have not confirmed whether additional fields such as account creation dates, device identifiers, or session logs were present. Because ActMobile has disputed the origin of the material, the exact scope and accuracy of the dataset remain unverified.

Why it matters

Email addresses paired with password hashes can be tested against other online accounts, increasing the chance of credential-stuffing attempts. IP addresses can reveal approximate locations or be correlated with other activity logs. For the organisation, even an unverified listing can prompt customer questions about data-handling practices and may trigger regulatory scrutiny depending on the jurisdictions involved.

What to do if you're exposed

Individuals who suspect their information may be involved should change passwords on any accounts that reuse the same credentials, enable multi-factor authentication where available, and monitor login notifications from services they use. A free exposure scan of an email address against known breach data can indicate whether the address has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.