InterPals Data Breach (2015): What Was Exposed & What To Do

In late 2015, the online penpal platform InterPals had its website compromised, resulting in the exposure of data associated with 3.4 million accounts. The incident was reported on November 4, 2015, and the compromised information included email addresses, names, dates of birth, geographic locations, usernames, and passwords stored as salted hashes. The scale of the exposure means that a substantial number of individuals who created accounts on the site may have had personal details placed outside the organization's control. Because the breach involved both contact information and credentials, the practical implications center on potential unauthorized access to accounts and the use of the data in other contexts.

Breaking down the breach

The facts available indicate that the breach occurred through a hack of the InterPals website in late 2015. A total of 3.4 million accounts were affected. The data types confirmed as exposed are dates of birth, email addresses, geographic locations, names, passwords, and usernames. The passwords were stored as salted hashes. No further details on the method of access, the duration of the intrusion, or any subsequent actions by the organization have been disclosed in the reporting.

How a breach like this happens

Incidents involving the exposure of user account data from websites commonly occur when attackers gain unauthorized access to a site's database or backend systems. This can result from vulnerabilities in web applications, weak authentication controls, or the compromise of administrative credentials. Once inside, an attacker may extract tables containing user records. When passwords are stored only as salted hashes rather than in plain text, the immediate usability of those credentials is reduced, though the hashes can still be subjected to offline cracking attempts. The exposure of additional profile fields such as names, dates of birth, and locations occurs when those fields are stored alongside the login information without separate access restrictions.

About InterPals

InterPals operates as an online platform that connects users for language exchange and pen-pal correspondence. Services of this type require users to register with personal details to create profiles and communicate with others. Organizations in this sector routinely collect and store email addresses for account management, usernames for identification, geographic information for matching purposes, and dates of birth to comply with age-related policies. A breach at such a service is consequential because the data set combines identifiers that can be used to locate individuals with credentials that may still be reused on other sites.

The information in question

The reported data types exposed in the InterPals incident are dates of birth, email addresses, geographic locations, names, passwords, and usernames. The passwords were stored as salted hashes. No additional categories of information, such as private messages or payment details, are named in the available facts. The precise contents of the data set remain limited to these fields as publicly reported.

What's at stake

For individuals whose information was exposed, the primary risks involve the potential reuse of email addresses and usernames across other services and the possibility that salted password hashes could be cracked over time. Geographic locations and dates of birth can contribute to more targeted phishing or social-engineering attempts when combined with names. For the organization, the incident highlights the long-term consequences of retaining large volumes of user data, including reputational damage and the costs associated with responding to affected users. No specific outcomes, such as confirmed account takeovers or further misuse, are documented in the reporting on this breach.

What to do if you're exposed

Individuals who believe they may have been affected should change passwords on the InterPals account and on any other sites where the same credentials were used. Enabling multi-factor authentication where available adds a further layer of protection. Monitoring email accounts for unusual activity and reviewing privacy settings on other platforms can reduce additional exposure. Readers can run a free exposure scan of their email address to check whether their information appears in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.