Gravatar Data Breach (2020): What Was Exposed & What To Do

In October 2020, a security researcher disclosed a scraping technique that allowed large-scale collection of data from Gravatar. The method resulted in 167 million records containing names, usernames and MD5 hashes of email addresses being obtained and later circulated. Of those, 114 million hashes were subsequently cracked, revealing the original email addresses alongside the accompanying name and username data. The exposure became searchable in Have I Been Pwned after Gravatar published an FAQ describing the incident. No further technical details on the scraping method or the exact distribution channels were released by the company at the time of reporting.

Breaking down the breach

The incident was reported on 3 October 2020. Public records state that 114 million accounts were affected. The data types confirmed as exposed are email addresses, names and usernames. The mechanism involved publication of a scraping technique rather than a conventional intrusion of internal systems. Timing of the initial scraping activity and the precise volume of data ultimately shared remain undisclosed beyond the figures noted above.

How a breach like this happens

Incidents involving bulk data collection from public or semi-public services often begin with the identification of an API or endpoint that returns user records without strict rate limiting or authentication. Researchers or other parties may publish scripts that iterate through possible inputs, such as sequential or patterned identifiers, to retrieve associated data fields. Once collected, the material can be processed offline, for example by attempting to reverse hashed values, and then redistributed through closed channels. Organisations may become aware only after the data surfaces in public breach repositories.

About Gravatar

Gravatar operates as a service that links user avatars to email addresses through cryptographic hashes, allowing the same image to appear across multiple websites without requiring separate uploads. It is commonly integrated into comment systems, forums and developer platforms. Services of this type routinely store identifiers such as email hashes, display names and usernames to enable consistent profile presentation. Exposure of these fields can affect a wide range of downstream sites that rely on the service for user representation.

The information in question

The reported data types are email addresses, names and usernames. The original collection included MD5 hashes of email addresses, of which 114 million were later reversed to reveal the plaintext addresses. No additional categories of information, such as passwords or payment details, are named in available reports. The precise scope of data held by Gravatar beyond these fields is not confirmed in the incident summary.

What's at stake

Revealed email addresses combined with names and usernames can be used for targeted phishing or to link online activity across platforms. The scale of 114 million records increases the likelihood that the data will be incorporated into larger datasets sold or shared for reconnaissance purposes. For the organisation, the incident underscores the exposure surface created by any publicly queryable user directory, even when no direct system compromise occurs.

Were you affected?

Individuals can check whether their email address appears in known breach datasets through public lookup services. Gravatar’s FAQ provides the company’s account of the event and any recommended steps for its users.

• Review accounts that use the same email or username for unusual activity.
• Consider using a dedicated email alias for services that rely on Gravatar.
• Monitor Have I Been Pwned or similar services for future appearances of the address.

AICompiled with AI assistance from public sources and published under our editorial standards.