Evite Data Breach (2013): What Was Exposed & What To Do

In 2019, Evite disclosed that it had discovered unauthorised access to a database archive containing records from 2013. The incident affected 101 million unique email addresses, along with additional personal details for service members. The exposure included passwords stored in plain text.

Incidents involving archived user data from earlier years remain relevant because large volumes of personal information continue to circulate after initial collection. When such archives are accessed without authorisation, the consequences extend to individuals whose details were provided years earlier, often without ongoing visibility into how their information is stored or protected.

What happened

Evite identified the unauthorised access in April 2019 during an internal investigation. The access involved a database archive that dated back to 2013. The exposed records contained 101 million unique email addresses, the majority belonging to invitation recipients rather than registered members.

For individuals who had created accounts, the archive also included names, phone numbers, physical addresses, dates of birth, genders, and passwords stored in plain text. No further technical details about the method of access or the duration of the unauthorised activity have been disclosed publicly.

How a breach like this happens

Breaches involving older database archives often occur when retained data is not isolated from production systems or when access controls weaken over time. Attackers may obtain credentials through unrelated compromises, exploit configuration errors, or use stolen authentication material to reach backup or legacy storage.

Once inside, an attacker can copy large volumes of records without triggering immediate detection if logging and monitoring are limited. Organisations that keep historical data for operational or compliance reasons sometimes retain it longer than necessary or in formats that lack modern encryption standards, increasing the window during which the information remains accessible.

About Evite

Evite operates an online platform that allows users to create, send, and manage digital invitations for events. The service collects contact information from both account holders and the people they invite, resulting in large stores of names, email addresses, and additional personal details.

Because the platform facilitates social and professional gatherings, the data it holds can include information about individuals who never created an account themselves. A breach at such a service therefore affects both active users and a wider set of contacts whose details were entered by others.

The information in question

The disclosed records included dates of birth, email addresses, genders, names, passwords, phone numbers, and physical addresses. Passwords were stored in plain text rather than in hashed form.

Public statements have not specified whether other categories of information, such as payment details or event-specific notes, were present in the accessed archive. The exact scope of data accessed beyond the listed fields remains unconfirmed.

What's at stake

Individuals whose email addresses and names were exposed face an increased likelihood of receiving targeted phishing messages that reference past events or personal details. Passwords stored in plain text can be tested directly against other online accounts, raising the chance of credential stuffing if the same passwords were reused elsewhere.

For Evite, the incident highlights the long-term costs of retaining historical user data without strong protective measures. Affected people may experience repeated misuse of their information over years, while the organisation must manage remediation, regulatory inquiries, and loss of user trust.

What to do if you're exposed

Change passwords on Evite and any other accounts that use the same or similar credentials. Enable multi-factor authentication wherever available, and review account activity for signs of unauthorised access.

Monitor email accounts for unusual messages and consider using a password manager to generate and store unique credentials. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.