Cit0day Data Breach (2020): What Was Exposed & What To Do

In November 2020, a large collection of data drawn from more than 23,000 websites and labelled Cit0day was posted for download on several hacking forums. The material contained 226.9 million unique email-address and password pairs, presented both as hashes and, in many cases, as cracked plaintext values. Independent checks confirmed that substantial portions of the data originated from legitimate breaches that had not previously been made public. The scale of the release means that many individuals may discover their credentials in the set even though they had no earlier indication that the sites they used had been compromised. Because the passwords appear in plaintext form for a large share of the records, the practical risk centres on reuse across other accounts rather than on the initial site compromises alone.

Breaking down the breach

The incident was first reported on 4 November 2020. The Cit0day collection aggregated credential data from more than 23,000 separate websites. It comprised 226.9 million distinct email-address and password combinations. Both hashed and cracked plaintext versions of the passwords were included. Verification by independent researchers established that many of the constituent breaches were genuine and had not been disclosed before. The dataset was subsequently supplied to Have I Been Pwned by dehashed.com.

How a breach like this happens

Collections of this type typically arise when attackers obtain credential databases from multiple online services over an extended period. Once the data are acquired, attackers often attempt to convert hashed passwords into plaintext through offline cracking. The resulting material is then assembled into larger archives and shared on forums. No single intrusion or responsible group has been identified in connection with the Cit0day compilation itself.

Who is Cit0day?

Cit0day is the name given to the aggregated dataset rather than to any single organisation. It draws records from thousands of websites that store user accounts. Services in this sector routinely hold email addresses and password credentials as part of normal account management. Exposure of such a compilation is consequential because it surfaces credentials from many smaller or previously unreported incidents in one place.

What data was at risk

The facts name email addresses and passwords as the data types present. The passwords appear both in hashed form and, for a substantial portion of records, in cracked plaintext. The precise contents contributed by each of the more than 23,000 source websites have not been itemised beyond these categories, so the exact scope of personal information tied to any individual record remains unconfirmed.

The real-world impact

Individuals whose credentials appear in the collection may face attempted account takeovers on any service where the same email and password combination is still in use. Organisations whose data form part of the set may experience follow-on abuse of user accounts and associated support costs. Because many of the source breaches had not been disclosed earlier, affected people had no prior opportunity to change the exposed passwords.

Were you affected?

Anyone concerned can check whether their email address appears in known breach data, including the Cit0day collection, through a free exposure scan offered by Have I Been Pwned. Practical next steps include changing passwords on any affected accounts, avoiding reuse of the same password elsewhere, and enabling multi-factor authentication where available.

AICompiled with AI assistance from public sources and published under our editorial standards.