Quidd Data Breach (2019): What Was Exposed & What To Do

What happened

The breach occurred at Quidd in 2019. Public records indicate that records belonging to 3.8 million users were taken, including email addresses, usernames, and passwords stored as bcrypt hashes. The data was subsequently sold and then redistributed extensively via hacking forums. No further technical details about the intrusion method or the exact date of the compromise have been disclosed in available reporting.

How a breach like this happens

Incidents involving the exposure of user credentials often begin with an attacker gaining access to an organisation’s systems through unpatched software, compromised administrative credentials, or misconfigured databases. Once inside, the attacker can copy tables that store account information. Passwords protected only by hashing, even when a strong algorithm such as bcrypt is used, remain vulnerable if the hashes are obtained and later subjected to offline attacks or if users have reused the same credentials elsewhere.

About Quidd

Quidd operated as an online marketplace where users could trade digital and physical collectibles, including stickers, cards, and toys. Services of this type maintain accounts that link individuals to transaction histories and item collections, making the protection of login credentials a core operational requirement. A breach at such a platform therefore touches both personal contact information and the means to access user-controlled assets within the service.

What was likely exposed

The facts released about the incident state that email addresses, usernames, and passwords stored as bcrypt hashes were taken. No additional categories of data, such as payment details or full names, are confirmed in the available reporting. Organisations in this sector commonly store further profile information, yet the precise contents of the Quidd dataset beyond the three named fields remain unconfirmed.

What's at stake

Exposed email addresses and usernames can be used for targeted phishing or to link individuals across other services where the same identifiers appear. Although the passwords were stored as bcrypt hashes, any account that reused those credentials on other sites faces a risk of unauthorised access. For Quidd, the redistribution of the data increases the chance that affected users will encounter follow-on attempts to compromise their accounts or related services.

Were you affected?

Individuals who created an account on Quidd before the 2019 incident can check whether their email address appears in known breach data by using a free exposure scan service. Changing passwords on Quidd and any other sites where the same credentials were used remains a practical first step, as does enabling multi-factor authentication where available. Monitoring email accounts for unusual login attempts can also help detect misuse of exposed information.

AICompiled with AI assistance from public sources and published under our editorial standards.