MyHeritage Data Breach (2017): What Was Exposed & What To Do

MyHeritage, the genealogy platform, suffered a data breach that exposed more than 92 million customer records. The company stated that the incident was identified after a security researcher discovered the data and contacted the organisation; public reporting of the event occurred on 26 October 2017, roughly seven months after the breach itself. The exposed records contained email addresses and salted SHA-1 password hashes.

Inside the incident

The breach affected more than 92 million records belonging to MyHeritage users. Only email addresses and salted SHA-1 password hashes were confirmed as present in the data set. The company has not disclosed the precise date or method of the intrusion. In 2019 the same data set appeared on a dark-web marketplace alongside other large breach collections and later circulated more widely.

How a breach like this happens

Incidents involving the exposure of large volumes of login credentials often begin with an attacker gaining access to an organisation’s systems through unpatched software, compromised administrative credentials, or misconfigured storage. Once inside, the attacker can copy database tables containing user records. In many cases the data remains undetected until a third party locates it on public or underground forums and alerts the affected company or the public.

Who is MyHeritage?

MyHeritage operates an online genealogy service that allows users to build family trees, upload DNA test results, and connect with relatives. Companies in this sector routinely store account credentials together with contact details and, frequently, sensitive personal or genetic information. A breach at such a service is consequential because the records can remain useful to malicious actors for years, especially when passwords are reused across other sites.

What data was at risk

The only data types explicitly named in connection with the incident are email addresses and salted SHA-1 password hashes. It is not publicly confirmed whether additional fields, such as names, birth dates, family-tree details or DNA-linked information, were also taken. Organisations of this type commonly hold further personal data, but the exact contents of the exposed MyHeritage data set remain unconfirmed beyond the two categories already stated.

What's at stake

Individuals whose email addresses and password hashes were exposed face the practical risk that attackers may attempt to use the credentials on other services where the same password is reused. The salted SHA-1 hashes require more computational effort to crack than unsalted hashes, yet offline attacks remain possible. For the organisation, the incident created long-term reputational and regulatory exposure, particularly once the data reappeared on underground markets two years later.

Were you affected?

Users can check whether their email address appears in known breach data sets by running a free exposure scan through a reputable service such as Have I Been Pwned. Practical next steps include changing the MyHeritage password and any other account that shares the same credentials, and enabling multi-factor authentication wherever available.

AICompiled with AI assistance from public sources and published under our editorial standards.