Knuddels Data Breach (2018): What Was Exposed & What To Do

In September 2018, a data breach at the German social media platform Knuddels exposed information belonging to 808,000 users. The incident left email addresses, usernames, real names, geographic locations, and passwords stored in plain text accessible to unauthorized parties. The exposure is significant for affected individuals because passwords held without encryption can be used directly for unauthorized access to accounts on Knuddels or on other sites where the same credentials were reused.

Inside the incident

The breach was reported on September 5, 2018. It affected 808,000 unique email addresses along with usernames, real names, the city of each person, and passwords stored in plain text. No further details on the method of intrusion, the timeline of access, or the volume of data exfiltrated have been disclosed in public reporting. Knuddels was subsequently fined €20,000 in connection with the incident.

How a breach like this happens

Incidents involving the exposure of user credentials and profile data often begin with an attacker obtaining access to an application server or database through unpatched software, weak authentication controls, or compromised administrative credentials. Once inside, the attacker can copy tables containing account information. When passwords are stored in plain text rather than hashed, the copied data can be used immediately without additional cracking steps. Public disclosure of such events typically follows either internal detection or external notification that the data has appeared on public forums or file-sharing sites.

About Knuddels

Knuddels operates as a German social media and chat platform. Organizations in this sector routinely collect and store account identifiers, contact details, and location information to enable user interaction and personalization. A breach at such a service is consequential because the data types involved are frequently sufficient to support account takeover attempts or targeted phishing campaigns against the same users on other platforms.

What data was at risk

• Email addresses
• Usernames
• Real names
• Geographic locations (city)
• Passwords stored in plain text

Why it matters

For individuals, the combination of email addresses and unencrypted passwords creates a direct pathway for attackers to test those credentials on other services. Real names and city data add context that can be used in social-engineering attempts. For the organization, the €20,000 fine reflects regulatory expectations around basic password-handling practices. The absence of Reported Details on how long the data remained accessible leaves the full scope of potential downstream use unknown.

What to do if you're exposed

Change the password on any Knuddels account and on every other service where the same password was used. Enable multi-factor authentication wherever available. Monitor email accounts for unusual login attempts or password-reset messages. Readers can run a free exposure scan of their email address against known breach data to check for additional appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.