CashCrate Data Breach (2016): What Was Exposed & What To Do

CashCrate, a cash-for-surveys website, experienced a data breach that exposed 6.8 million records. The incident dates to November 2016, with public reporting of the breach occurring in June 2017. The exposed data included names, physical addresses, email addresses, and passwords, with older accounts storing passwords in plain text and newer accounts using weak MD5 hashes.

Inside the incident

The breach involved the unauthorized exposure of 6.8 million user records from CashCrate. Public information indicates the compromise occurred in November 2016, though details on how access was obtained remain undisclosed. The data included names, physical addresses, email addresses, and passwords stored without modern hashing for older accounts and with MD5 hashing for newer ones. No further technical specifics on the intrusion method or duration of access have been confirmed in available reports.

How a breach like this happens

Incidents involving the exposure of user credentials and personal details often result from unauthorized access to application databases. Attackers may exploit vulnerabilities in web applications, obtain stolen credentials from other sources, or leverage misconfigured servers to extract records. Once inside, they can copy tables containing account information. Passwords stored in plain text or with outdated hashing methods such as MD5 are particularly susceptible to offline cracking if the data later circulates.

CashCrate and its sector

CashCrate operated as a platform that compensated users for completing surveys and other online tasks. Services in this sector routinely collect registration details to verify participants and distribute payments. This includes names, physical addresses for mailing checks or gift cards, email addresses for account management, and passwords to secure user logins. A breach at such a site can affect a large number of individuals who signed up over many years of operation.

The information in question

The records exposed in the CashCrate incident contained email addresses, names, physical addresses, and passwords. Passwords for older accounts were stored in plain text, while newer accounts used MD5 hashes. No additional data categories have been confirmed as part of the breach. Organizations of this type commonly hold further details such as account activity logs or payment information, but whether those were affected remains unconfirmed.

The real-world impact

Individuals whose records were exposed face the possibility that their email addresses and passwords could be used in attempts to access other online accounts where the same credentials were reused. Physical addresses combined with names may increase the volume of targeted unsolicited mail or phishing attempts. For CashCrate, the incident created a record of inadequate credential protection that could affect user trust and future operations. The scale of 6.8 million records means these risks apply to a substantial number of people.

If your data was in this breach

Review any CashCrate account you may have created and change the password if the service remains active. Use a different password for every site and enable multi-factor authentication where available. Monitor email accounts for unusual login attempts or messages that reference the exposed details. Readers can run a free exposure scan of their email address against known breach data to check for appearances in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.