Reincubate Data Breach (2017): What Was Exposed & What To Do

People whose email addresses, names and password hashes were included in records from Reincubate now face the possibility that those details have circulated outside the company for years. The records originate from a backup dated November 2017 and contain more than 616,000 unique entries. The incident involves the exposure of a data backup created by the company in November 2017. The newest records in the released set date from several months before that backup. Public reporting of the event occurred on 11 May 2017, while the data set itself was referenced in October 2020. No further details on the method of access or the exact date the backup left the company’s control have been disclosed.

Breaking down the breach

The available information states that a backup containing 616,000 unique email addresses, names and passwords was exposed. The passwords were stored as PBKDF2 hashes. The backup itself is dated November 2017. No information has been released about how the backup was obtained or whether additional files were taken at the same time.

How a breach like this happens

Incidents involving the release of stored backups often begin with unauthorised access to internal systems or storage locations. Once inside, an actor may locate and copy archived data without triggering immediate detection. Backups created for recovery purposes can contain large volumes of user records and are sometimes retained longer than active production data, increasing the window during which they remain available if controls are insufficient.

About Reincubate

Reincubate is an app-data company whose services involve handling user information from mobile devices and applications. Organisations in this sector routinely process contact details and authentication data to provide recovery, migration or analysis features. A breach at such a firm is consequential because the records it holds are often used across multiple services and can remain valid for extended periods.

The information in question

The exposed records include email addresses, names and passwords stored as PBKDF2 hashes. No other data types have been confirmed in public statements about this incident. Organisations of this kind commonly retain additional profile or device information, yet the precise contents of the released backup remain limited to the three categories named above.

Why it matters

Email addresses combined with names can be used for targeted phishing or account-recovery attempts on other services. Hashed passwords require computational effort to reverse, but older hashing methods increase that possibility over time. For the organisation, the incident highlights the long-term sensitivity of retained backup material even when the original event occurred several years earlier.

If your data was in this breach

Review any accounts that still use the exposed email address and change passwords where the same credential may have been reused. Enable multi-factor authentication on important services. Readers can run a free exposure scan of their email address against known breach data sets to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.