ClixSense Data Breach (2016): What Was Exposed & What To Do

In September 2016, the paid-to-click site ClixSense suffered a data breach that exposed records belonging to 2.4 million subscribers. The compromised data was posted online, with the actors responsible stating that the published material formed only a subset of a larger collection totalling 6.6 million records. The breach was reported on 4 September 2016. Public information on the method of intrusion, the precise date of access, or the full scope of any additional records remains limited to the attackers’ claims.

Inside the incident

The published data set contained names, physical addresses, email addresses, IP addresses, genders, dates of birth, account balances, payment histories, and passwords stored in plain text. No further technical details about how the data was obtained have been confirmed in public reporting.

How a breach like this happens

Incidents involving the exposure of user account data commonly begin with unauthorised access to an organisation’s systems, whether through compromised credentials, unpatched software, or misconfigured databases. Once inside, an actor can copy files containing personal and authentication information and later publish or sell the material. The presence of plain-text passwords indicates that stored credentials were not protected by hashing or encryption at the time of the incident.

About ClixSense

ClixSense operated as a paid-to-click platform where users completed surveys and other tasks in exchange for small payments. Services of this type maintain accounts that record personal identifiers, contact details, demographic information, and financial transaction histories to manage rewards and compliance. A breach at such a site therefore places at risk both the personal profiles and the payment-related records of its user base.

The information in question

The records posted online included account balances, dates of birth, email addresses, genders, IP addresses, names, passwords, and payment histories. The exact contents of any additional records beyond the published 2.4 million have not been independently verified.

What's at stake

Plain-text passwords increase the chance that affected accounts could be accessed on other sites where users reused the same credentials. Email addresses combined with names and dates of birth can facilitate targeted phishing or account-recovery attempts. Payment histories and account balances may reveal patterns of online activity that some individuals prefer to keep private. For the organisation, the incident highlights the long-term consequences of storing authentication data without additional protective measures.

What to do if you're exposed

Change the password on the affected account and on any other services that used the same or similar credentials. Enable multi-factor authentication where available and review recent account activity for signs of unauthorised use. Individuals can also run a free exposure scan of their email address against known breach data sets to check for further appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.