CityBee Data Breach (2021): What Was Exposed & What To Do

Data breaches targeting mobility and sharing-economy platforms have become a recurring feature of the digital threat landscape, where services that collect both routine contact details and official identity documents can become single points of concentrated personal information. In February 2021 the Lithuanian car-sharing company CityBee disclosed that personal records belonging to 110,000 customers had been exposed. The incident is notable because it involved government-issued identifiers alongside credentials stored in an outdated hashing format, illustrating how even mid-sized regional operators can hold data whose misuse carries lasting consequences for individuals.

What happened

On 5 February 2021 CityBee announced that it had suffered a data breach affecting 110,000 customers. The company stated that the exposed information included names, email addresses, government-issued IDs and passwords stored as unsalted SHA-1 hashes. No further technical details about the intrusion method, the date of the initial compromise or the volume of any additional files were made public at the time of the announcement.

How a breach like this happens

Incidents involving customer databases at service providers often begin with the exploitation of internet-facing systems that have not received timely security updates or that rely on weak authentication controls. Once initial access is obtained, attackers frequently search for database servers or backup files containing user records. Credentials protected only by unsalted or weakly salted hashes can then be processed offline with widely available tools, increasing the chance that passwords will be recovered and reused elsewhere.

Who is CityBee?

CityBee operates a car-sharing service in Lithuania, providing registered users with short-term vehicle access through a mobile application. Companies of this type routinely collect names, contact details, payment information and official identity documents to satisfy regulatory requirements for driver verification and insurance. A breach at such an operator is consequential because the combination of verified identity data and account credentials can facilitate both financial fraud and impersonation in contexts that require proof of identity.

The information in question

The February 2021 disclosure listed four categories of data: names, email addresses, government-issued IDs and passwords stored as unsalted SHA-1 hashes. No additional data types were confirmed in the public statement, and the precise scope of any other records that may have been present in the affected systems remains unconfirmed.

The real-world impact

Individuals whose government-issued identifiers and email addresses appear in the exposed set face an elevated risk of targeted phishing and identity-verification fraud. Passwords stored without modern salting or iteration counts can be recovered more readily, potentially allowing unauthorised access to CityBee accounts or to other services where the same credentials were reused. For the organisation, the incident required notification to regulators and customers, along with remediation of the affected credential storage practices.

Were you affected?

Anyone who used CityBee before February 2021 should assume their information may be involved and take the following steps:

• Change the password associated with the CityBee account and any other service that used the same password.
• Enable multi-factor authentication on email and financial accounts.
• Monitor statements and official correspondence for signs of identity misuse.
• Run a free exposure scan of your email address against known breach data to determine whether your details have appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.