Avvo Data Breach (2019): What Was Exposed & What To Do

In December 2019, data linked to the Avvo lawyer directory service appeared on an online forum, listing email addresses and password hashes for 4.1 million accounts. The material was also referenced in extortion attempts directed at the company. Public records show that repeated contact with Avvo over the following week produced no response, and the data set was later confirmed through cross-checks with known subscribers to breach-notification services. The exposure underscores the practical consequences for users who registered with the service, as reused credentials can enable unauthorized access to other accounts.

Breaking down the breach

The incident first came to wider attention on December 17, 2019, when the data set was posted publicly. It contained 4.1 million unique email addresses paired with SHA-1 hashes, most likely corresponding to user passwords. Reports indicate the underlying exposure may have occurred earlier than the December posting date. No official statement from Avvo has been recorded in available accounts of the event, and details such as the precise method of initial access remain undisclosed.

How a breach like this happens

Incidents involving the public posting of email and password data often begin with unauthorized access to a service’s stored user records. Once obtained, the information can be packaged and shared on forums where it may be used for further attempts at account takeover or extortion. In many cases the original compromise occurs through vulnerabilities in web applications, compromised administrative credentials, or third-party integrations, though the specific vector in any single case is determined only after investigation.

About Avvo

Avvo operates as an online directory connecting individuals with lawyers, allowing users to search for legal professionals and, in some cases, to create accounts for direct contact or reviews. Services of this type routinely collect email addresses for account creation and may store password credentials to manage user sessions. A breach at such a platform is consequential because the email addresses often belong to people seeking legal assistance, a context in which privacy expectations are high and the accounts may be linked to other professional or personal services.

What was likely exposed

The published data set is described as containing email addresses and SHA-1 password hashes. No additional categories of information, such as names, addresses, or case details, are named in reports of the incident. Organizations in this sector commonly hold profile information and communication records, yet the exact scope of records included in this exposure has not been confirmed beyond the two data types noted.

What's at stake

For individuals, the primary concern is that email addresses paired with password hashes can be tested against other online services, especially where the same credentials are reused. This can lead to account takeovers without further action by the affected person. For the organization, the incident creates operational and reputational questions around data retention and response procedures, though the long-term effects depend on factors that remain outside public records.

Were you affected?

Individuals can check whether their email address appears in known public data sets by using a free exposure scan offered by established breach-notification services. If an address is found, the immediate steps are to change the password on the affected account and on any other service where the same password was used, and to enable multi-factor authentication where available. Monitoring for unusual login activity on linked accounts provides an additional practical measure.

AICompiled with AI assistance from public sources and published under our editorial standards.