Raychat Data Breach (2021): What Was Exposed & What To Do

In January 2021, the Iranian social media platform Raychat experienced a data breach that exposed records associated with 939,000 unique email addresses. The incident came to public attention on 31 January 2021 after the data set was shared with Have I Been Pwned by the service dehashed.com. Available details confirm the presence of names, IP addresses, browser user-agent strings and passwords stored as bcrypt hashes, though the precise circumstances of the access remain undisclosed.

What happened

The breach affected the now-defunct Raychat service and involved the exposure of 939,000 unique email addresses along with associated user information. Records included names, IP addresses, browser user-agent details and passwords held as bcrypt hashes. No information has been released about the method of intrusion, the duration of unauthorised access or the total volume of files involved beyond the count of unique email addresses. The data set was subsequently provided to breach-notification services, which allowed the incident to be recorded and indexed.

How a breach like this happens

Incidents involving the exposure of user credentials and associated metadata often begin with unauthorised access to an organisation’s systems, whether through compromised administrative credentials, unpatched software or misconfigured storage. Once inside, an actor can copy database tables or exported files containing user records. In many cases the data later appears on public or semi-public forums, after which third-party services obtain and analyse samples. The presence of bcrypt-hashed passwords indicates that the platform applied a one-way hashing function at the time of storage, a standard practice that increases the computational effort required to recover plaintext values.

About Raychat

Raychat operated as an Iranian social-media platform, providing users with messaging and networking features typical of such services. Platforms of this kind routinely collect account identifiers, contact details and technical metadata generated during normal use. Because Raychat is now defunct, affected individuals no longer have an active service relationship with the organisation, which limits direct notification options and places greater reliance on third-party breach disclosures for awareness.

The information in question

The disclosed data set contains email addresses, names, IP addresses, browser user-agent strings and passwords stored as bcrypt hashes. These elements allow identification of individual accounts and provide technical context about the devices and locations from which users connected. The exact scope of any additional fields that may have existed in the original database has not been confirmed. Organisations in this sector commonly retain similar categories of information to support account creation, session management and abuse prevention.

The real-world impact

Exposure of email addresses and names can facilitate targeted phishing or account-enumeration attempts. IP addresses and user-agent strings may reveal approximate locations and device types, information that can be combined with other sources to build more detailed profiles. Bcrypt-hashed passwords require significant computational resources to attempt recovery, yet any users who reused those passwords on other services remain at risk of credential-stuffing attacks if the hashes are eventually cracked. For the organisation, the incident adds to a public record of security events at a time when the service has already ceased operations.

What to do if you're exposed

Individuals who believe their information may be involved should change passwords on any accounts that share the exposed credentials and enable multi-factor authentication where available. Monitoring email accounts for unusual login attempts and reviewing privacy settings on other platforms can reduce further exposure. Readers may also run a free exposure scan of their email address through established breach-notification services to check whether their details appear in known data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.