Scentbird Data Breach (2020): What Was Exposed & What To Do

In June 2020, the online fragrance subscription service Scentbird suffered a data breach that exposed the personal information of 5.8 million customers. The incident came to public attention on 22 June 2020 after the data set was provided to Have I Been Pwned by breachbase.pw. The records included names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes, and indicators of password strength. The scale of the exposure means that a substantial number of individuals now face the possibility that their details have circulated beyond the company’s systems. Because the breach involved both identifying information and password data, the practical consequences depend on whether those passwords were reused on other services.

Inside the incident

The breach was reported in June 2020 and affected 5.8 million customer records. The data types confirmed as exposed are names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes, and password-strength indicators. No further technical details about the method of access, the precise date of the intrusion, or the duration of exposure have been disclosed in the available reporting. The data set was supplied to Have I Been Pwned by breachbase.pw.

How a breach like this happens

Incidents involving the exposure of customer databases commonly result from unauthorised access to web-application servers or backend storage systems. Attackers may exploit vulnerabilities in login pages, third-party integrations, or misconfigured access controls to extract tables containing user records. Once obtained, the data can be packaged and shared on forums or data-aggregation sites. The use of bcrypt hashing for passwords indicates that stored credentials were protected by a deliberately slow hashing function, though the strength of individual passwords still varies.

Who is Scentbird?

Scentbird operates an online subscription service that delivers fragrance samples to customers on a recurring basis. Like other direct-to-consumer retailers, the company collects standard account and profile information to manage subscriptions, process payments, and personalise recommendations. Such organisations routinely store names, contact details, dates of birth for age verification or marketing segmentation, and login credentials. A breach at a service of this type is consequential because the data set can support targeted account takeovers or identity-related misuse when combined with information from other sources.

What data was at risk

The records made available include names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes, and indicators of password strength. No additional categories of data, such as payment-card details or shipping addresses, are named in the reported summary. The exact contents of any individual record remain unconfirmed beyond these fields.

The real-world impact

Individuals whose information appears in the data set may receive increased volumes of phishing messages sent to the exposed email addresses. If a password was reused elsewhere, the bcrypt hash could be subjected to offline cracking attempts, potentially allowing access to other accounts. Dates of birth and names can assist in identity-verification processes at other services. For the organisation, the incident creates operational costs associated with customer notification, credential resets, and any regulatory reporting obligations that may apply.

If your data was in this breach

Review your email account for any password-reset messages from Scentbird or related services and change the password on the Scentbird account if you still use it. Where the same password or a close variant appears on other sites, update those credentials as well and enable multi-factor authentication where available. You can run a free exposure scan of your email address against known breach data sets to check for additional appearances of your information.

AICompiled with AI assistance from public sources and published under our editorial standards.