Mappery Data Breach (2018): What Was Exposed & What To Do

In December 2018, the mapping website Mappery suffered a data breach that exposed information associated with more than 205,000 user accounts. The incident was reported on December 11, 2018, and included email addresses, usernames, geographic locations, and passwords stored as unsalted SHA-1 hashes. No further details on the method of access or the precise date of the intrusion have been made public, and the organization did not respond to inquiries about the event.

What happened

The breach affected 205,000 unique email addresses along with associated usernames, geographic locations, and passwords. The passwords were stored in unsalted SHA-1 format. Public records indicate the incident was identified and reported in December 2018. No information has been released about how the data were obtained or whether the exposure was limited to a single dataset or extended over time.

How a breach like this happens

Incidents involving the exposure of user credentials and location data often result from unauthorized access to application databases or backup files. Attackers may exploit unpatched software, weak authentication controls, or misconfigured storage systems to retrieve records in bulk. Once obtained, the data can be copied and later circulated without the knowledge of the affected organization. The use of unsalted SHA-1 hashing, a method known to be computationally feasible to reverse under certain conditions, increases the potential usability of any passwords that were captured.

Who is Mappery?

Mappery operated as a website focused on maps and geographic information contributed or viewed by its users. Organizations of this type typically maintain accounts that link email addresses and usernames to location-based content. A breach at such a service is consequential because the data can reveal patterns of user movement or interests tied to specific places, in addition to the more common exposure of login credentials.

What was likely exposed

The reported incident included email addresses, usernames, geographic locations, and passwords stored as unsalted SHA-1 hashes. These data types were explicitly named in connection with the 205,000 affected accounts. No additional categories of information, such as full names, payment details, or private messages, have been confirmed as part of the exposure. The exact contents of any individual record remain unverified beyond the categories listed at the time of reporting.

The real-world impact

Individuals whose information appeared in the dataset face the possibility that their email addresses and usernames could be used for targeted phishing or account enumeration on other services. Geographic locations tied to accounts may disclose habitual travel or areas of interest. Passwords stored as unsalted SHA-1 hashes could be subjected to offline cracking attempts, raising the risk of credential reuse on unrelated sites. For the organization, the incident represents a loss of user trust and potential regulatory scrutiny, though the scale of any follow-on effects has not been quantified.

What to do if you're exposed

Anyone who used Mappery should change the password associated with that account and any other service where the same password was reused. Enable multi-factor authentication on accounts that support it, and monitor email for unusual login attempts or unsolicited messages. A free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.