i-Dressup Data Breach (2016): What Was Exposed & What To Do

Data breaches involving online platforms that store user credentials have become a recurring feature of the digital environment, often stemming from unpatched vulnerabilities in web applications. The i-Dressup incident, reported in July 2016, illustrates how such exposures can affect millions of accounts when basic security controls are absent.

Public records indicate that the breach occurred in June 2016 and involved the exposure of more than two million user accounts from the teen-oriented social site i-Dressup. At the time of reporting, the operators could not be reached and an underlying flaw remained unaddressed, with some accounts allegedly reaching a higher total figure.

What happened

In June 2016 the i-Dressup platform was compromised, resulting in the exposure of over 2 million user accounts. The incident was publicly reported on 15 July 2016. At that time the site operators were not contactable, and the SQL injection vulnerability that enabled the access was still present. The breach included email addresses and passwords stored without encryption.

How a breach like this happens

Incidents of this type commonly begin with an attacker identifying an input field on a website that does not properly validate or sanitize data. When that field is connected to a database, an attacker can submit specially crafted commands that cause the database to return records it should not. Once access is obtained, large volumes of stored data can be retrieved quickly if no additional controls limit the query results or encrypt sensitive fields such as passwords.

About i-Dressup

i-Dressup operated as an online community aimed at teenagers, allowing users to create profiles, interact with others, and share content. Platforms in this sector routinely collect registration details including email addresses and passwords to manage accounts and maintain user sessions. When such a service experiences a breach, the data involved can remain accessible long after the initial event because historical breach repositories are frequently searched and reused.

What was likely exposed

The reported data types consist of email addresses and passwords. The passwords were stored in plain text rather than in a hashed format. Exact confirmation of every field present in the dataset has not been published.

• Email addresses
• Passwords stored in plain text

What's at stake

Exposed email addresses can be used for targeted phishing campaigns or to link individuals to other online services. Plain-text passwords increase the chance that the same credentials will be tested against additional sites, potentially leading to account takeovers elsewhere. For the organisation, the incident highlighted gaps in both technical controls and incident-response communication.

What to do if you're exposed

Change the password on the affected account and on any other service where the same password was used. Enable multi-factor authentication wherever available. Monitor email accounts for unusual login attempts or messages that request further personal information. Readers can run a free exposure scan of their email address to check whether their information has appeared in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.