Eskimi Data Breach (2020): What Was Exposed & What To Do

In late 2020, a data breach at the advertising technology company Eskimi exposed records belonging to 1.2 million individuals. The incident was reported on 25 September 2020 and involved 26 million records that included usernames, dates of birth, genders, geographic locations, email addresses and passwords stored as unsalted MD5 hashes. The exposure matters because the data can be used for targeted account takeovers, identity linkage and further social-engineering attempts against the people whose details appeared in the dataset.

Inside the incident

The breach affected an AdTech platform that processes user information for digital advertising campaigns. Public reporting at the time stated that 26 million records were obtained, containing 1.2 million unique email addresses along with the other fields listed above. No information has been released about the method of intrusion, the date the data were first accessed, or whether the passwords were subsequently cracked. The organisation has not published a detailed timeline or confirmed whether the unsalted MD5 hashes were later reversed.

How a breach like this happens

Incidents involving advertising platforms often begin with the compromise of a web application, an exposed database, or a misconfigured cloud storage bucket. Once initial access is gained, attackers search for tables that store user profiles and authentication data. Passwords kept as unsalted MD5 hashes can be processed offline with widely available tools, increasing the chance that some credentials become usable. The same datasets frequently contain demographic fields that allow records to be matched across other services.

Eskimi and its sector

Eskimi operates in the programmatic advertising sector, where platforms collect and match user attributes to deliver targeted advertisements across websites and mobile applications. Companies in this field routinely hold email addresses, device identifiers, location data and basic demographic details to build audience segments. A breach at such a firm is consequential because the information is already structured for marketing use and can be repurposed for fraud or more precise phishing campaigns.

What was likely exposed

The breach record names the following data types: dates of birth, email addresses, genders, geographic locations, passwords and usernames. The passwords were stored as unsalted MD5 hashes. The exact contents of every record remain unconfirmed beyond these categories, and no additional fields such as full names or financial details have been reported.

What's at stake

For individuals, the combination of email addresses, usernames and demographic information can facilitate account-recovery attacks on other services that reuse the same credentials. Unsalted MD5 hashes are comparatively weak, so some passwords may already have been recovered and circulated. For the organisation, the incident highlights the long-term liability that comes from retaining identifiable user data in advertising systems without stronger protective controls.

Were you affected?

Check whether your email address appears in public breach datasets by running a free exposure scan on a reputable site that aggregates known incidents. If your address is listed, change the password on any account that still uses it, enable multi-factor authentication, and review recent login activity. Organisations that held the data have not published a notification portal, so individual monitoring of personal accounts remains the most direct step.

AICompiled with AI assistance from public sources and published under our editorial standards.