Dubsmash Data Breach (2018): What Was Exposed & What To Do

In December 2018, the video messaging service Dubsmash experienced a data breach that exposed information associated with 161.7 million user accounts. The incident was reported that month, and the data later appeared listed for sale on a dark web marketplace in 2019 alongside other large breach collections before circulating more broadly. The breach involved email addresses, usernames, and PBKDF2 password hashes, with additional fields also recorded as exposed. Public detail on the method of access, exact timing of the intrusion, or the organization’s response remains limited.

Inside the incident

The breach was publicly reported on December 1, 2018. Records indicate that 161.7 million unique email addresses were affected, together with usernames and PBKDF2 password hashes. In 2019 the data set appeared on a dark web marketplace and subsequently circulated more widely.

No further technical details about the intrusion itself, such as the vector used or the period during which access occurred, have been disclosed in available reporting.

How a breach like this happens

Incidents involving large user databases commonly result from unauthorized access to application servers or backend storage systems. Attackers may exploit vulnerabilities in web applications, obtain valid credentials through other means, or leverage misconfigured access controls to reach data stores.

Once inside, an actor can copy tables containing user records. Passwords stored as hashes, even when using functions such as PBKDF2, can later be subjected to offline cracking attempts if the hashes are obtained.

Dubsmash and its sector

Dubsmash operated as a video messaging platform that allowed users to create and share short videos with audio. Services of this type routinely collect account identifiers, contact details, and device or profile information to support user registration, content delivery, and personalization.

A breach at a consumer-facing application with a large registered user base can expose routine account data at scale. Such events are consequential because the information supports everyday online activity and can be reused across other services.

The information in question

The records list the following data types as exposed: email addresses, geographic locations, names, passwords, phone numbers, spoken languages, and usernames. The passwords were stored as PBKDF2 hashes. Exact confirmation of every field present in the data set that later circulated has not been independently verified beyond the reported summary.

What's at stake

Exposed email addresses and usernames can be used for targeted phishing or to identify accounts on other platforms. Password hashes, while not immediately usable, may be processed offline in attempts to recover plaintext credentials that could then be tested elsewhere.

Additional fields such as phone numbers and locations add context that can support more precise social-engineering attempts or unwanted contact. For the organization, the incident highlights the long-term handling requirements for large volumes of user records once they leave controlled environments.

Were you affected?

Individuals can check whether their email address appears in known breach data sets through free lookup services that aggregate public breach records. If an address is found, standard steps include changing passwords on the affected service and any other accounts that reuse the same credential, and enabling multi-factor authentication where available.

• Review account activity on Dubsmash and linked services for signs of unauthorized access.
• Replace any password that matches or resembles the one used on the platform.
• Monitor email and phone channels for unexpected messages that reference the exposed details.
• Consider a password manager to generate and store unique credentials going forward.

AICompiled with AI assistance from public sources and published under our editorial standards.