Coinmama Data Breach (2017): What Was Exposed & What To Do

In August 2017 Coinmama, a cryptocurrency brokerage, suffered a data breach that affected 479,000 user accounts. The incident remained undetected until February 2019, when the exposed records were provided to Have I Been Pwned by security researcher Adam Davies. The breach is one of many that continue to surface years after initial compromise, illustrating how data from online financial services can remain at risk long after the event itself.

What happened

The records show that the breach took place in August 2017 and involved 479,000 subscribers. Exposed data included email addresses, usernames, and passwords stored as MD5 WordPress hashes. No further details on the method of intrusion, the duration of access, or the total volume of data removed have been made public. The incident was first reported in connection with the 2017 date, yet confirmation and wider awareness occurred only after the data set appeared in February 2019.

How a breach like this happens

Breaches affecting online account databases commonly begin with an attacker obtaining entry through a vulnerable web application, weak authentication controls, or compromised administrative credentials. Once inside the environment, the intruder can query user tables and export the contents. In many cases the stolen material is not immediately used or disclosed, allowing months or years to pass before the organisation or a third party identifies the loss. Passwords stored with older hashing methods such as unsalted MD5 are particularly susceptible to offline cracking once the files leave the original system.

Who is Coinmama?

Coinmama operates as a cryptocurrency brokerage, enabling customers to purchase digital assets through registered accounts. Services of this type collect and retain identifiers necessary for account creation and transaction processing, including email addresses, usernames, and password credentials. Because these platforms handle repeated logins and financial activity, the data they store can be attractive to actors seeking either direct account access or material for further targeting.

The information in question

The breach record lists email addresses, usernames, and passwords stored as MD5 WordPress hashes. No additional categories of information, such as full names, addresses, payment details, or transaction histories, are confirmed in the available facts. Organisations in this sector routinely hold account credentials and contact information; however, the precise scope of data removed in this case remains limited to the three fields named above.

What's at stake

Individuals whose records were exposed face the possibility that their email addresses and usernames could be used for targeted phishing or that cracked passwords could grant access to Coinmama accounts or other services where the same credentials were reused. For the organisation, the incident represents a loss of customer trust and potential regulatory scrutiny common to entities that store authentication data. The delayed discovery also means that any subsequent misuse of the information may have occurred without immediate visibility to either the company or affected users.

If your data was in this breach

Anyone who held a Coinmama account during the relevant period should change the password on that service and on any other site where the same password was used. Enabling multi-factor authentication where available reduces the value of a compromised password. Monitoring account activity for unusual logins or transactions provides an early indication of misuse. Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.