Appen Data Breach (2020): What Was Exposed & What To Do

In June 2020, the AI training data company Appen experienced a data breach that exposed information belonging to approximately 5.9 million users. The incident came to light when the data appeared for sale online and was later shared with Have I Been Pwned. This event occurred amid a broader pattern of large-scale exposures affecting organisations that collect and process personal data for commercial purposes.

Breaking down the breach

The breach was reported on 22 June 2020. It involved the exposure of details for 5.9 million users. The data included names, email addresses and passwords stored as bcrypt hashes. Some records also contained phone numbers, employers and IP addresses. The material was subsequently sold online and provided to Have I Been Pwned by dehashed.com. No further details on the method of access, exact timing of the intrusion or total volume of files have been disclosed.

How a breach like this happens

Incidents involving the exposure of user account data often begin with unauthorised access to company systems that store authentication credentials and profile information. Attackers may exploit vulnerabilities in web applications, misconfigured databases or compromised third-party services to extract records. Once obtained, the data can be packaged and offered for sale on underground forums. Passwords stored as bcrypt hashes require additional computational effort to attempt recovery, though weaker or reused passwords remain at higher risk of being cracked.

Who is Appen?

Appen is a company that supplies training data and annotation services for machine-learning systems. Organisations in this sector routinely collect user information to build and maintain large datasets, which can include contact details, employment information and technical identifiers such as IP addresses. A breach at such a firm is consequential because the records often combine personal identifiers with credentials, creating potential for misuse across multiple online services.

What was likely exposed

The facts released about the incident name the following data types: email addresses, employers, IP addresses, names, passwords stored as bcrypt hashes, and phone numbers. The precise contents of every record remain unconfirmed beyond these categories. Organisations of this type commonly hold additional profile or project-related information, but no further details have been verified in connection with this event.

The real-world impact

Individuals whose information appeared in the dataset face the possibility that their email addresses and hashed passwords could be used in attempts to access other accounts where the same credentials were reused. Phone numbers and employers can facilitate targeted phishing or social-engineering attempts. For the organisation, the exposure adds to the cumulative record of incidents that affect trust in data-handling practices within the AI-services sector. No specific financial losses or regulatory outcomes have been disclosed in the available facts.

What to do if you're exposed

Review any accounts that use the exposed email address and update passwords, especially where reuse may have occurred. Enable multi-factor authentication on important services. Monitor for unusual login activity and consider using a password manager to generate and store unique credentials. Readers can run a free exposure scan of their email address to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.