Dave Data Breach (2020): What Was Exposed & What To Do

Inside the incident

The breach affected records associated with roughly 3 million people. The exposed material included names, dates of birth, email addresses, phone numbers, physical addresses, social security numbers and passwords stored as bcrypt hashes. The data set was later supplied to Have I Been Pwned by dehashed.com. No further technical details about the intrusion method or the precise timeline of access have been disclosed in public reporting.

How a breach like this happens

Incidents that result in large volumes of customer records appearing on public forums often begin with unauthorised access to an organisation’s systems or third-party service providers. Once obtained, the data may be packaged and shared or sold in underground spaces. The presence of hashed passwords indicates that some protective measures were in place, yet the overall volume of structured personal information still became available.

Who is Dave?

Dave operates as a mobile application that provides banking and financial services to individual users. Organisations of this type routinely collect and store identifying information, contact details and account credentials to deliver their services and comply with regulatory requirements. A compromise at such a service therefore touches data that users rely on for everyday financial activity.

What data was at risk

The records that surfaced contained dates of birth, email addresses, names, passwords, phone numbers, physical addresses and social security numbers. Passwords were stored as bcrypt hashes and social security numbers were encrypted. The exact scope of every field contained in the 7.5 million rows remains limited to what has been described in public summaries of the incident.

What's at stake

Individuals whose information appeared in the data set face the possibility that their details could be used for targeted account access attempts or identity-related fraud. For the organisation, the exposure of customer records can lead to regulatory scrutiny and loss of user trust. Because the data has already circulated on a public forum, the window for secondary misuse is extended.

What to do if you're exposed

Anyone who used the Dave service around the time of the incident should review account activity for unusual logins and consider changing passwords, especially where the same credentials were reused elsewhere. Enabling multi-factor authentication on linked financial accounts adds a further layer of protection. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.