ShareThis Data Breach (2018): What Was Exposed & What To Do

What happened

The incident was reported on 9 July 2018. Public records state that 41 million unique email addresses were exposed, together with names and, for some records, dates of birth and password hashes. The data later appeared listed for sale on a dark-web marketplace in 2019 alongside other large breach collections and subsequently circulated more widely. The timing of the original intrusion, the method used to obtain the data, and the precise number of records containing each data element remain undisclosed in available reporting. The material was later supplied to Have I Been Pwned by dehashed.com.

How a breach like this happens

Incidents involving the exposure of user account data from online services commonly occur when stored records are accessed without authorisation. This can result from remote exploitation of software vulnerabilities, the use of stolen administrative credentials, or misconfigured storage systems that leave data accessible. Once obtained, the material may be packaged and offered on underground marketplaces, after which copies often propagate through multiple channels. The exact sequence in any single case is determined only after forensic examination, which has not been detailed for this incident.

ShareThis and its sector

ShareThis operated as a social bookmarking and content-sharing service that allowed users to save and distribute links across platforms. Services of this type maintain user accounts to enable sharing features, which typically requires the collection of email addresses, names, and authentication credentials. Dates of birth may be stored when age verification or demographic features are offered. A breach at such a provider is consequential because the data can be combined with information from other sources to build more complete profiles of individuals.

The information in question

The records are described as containing email addresses, names, dates of birth, and password hashes. The exact scope of each category across the full 41 million records is not specified in public reporting. Organisations in this sector routinely store email addresses for account management and communication, names for user identification, and hashed passwords for authentication. Dates of birth appear in some user profiles but are not universal. The precise contents of the exposed dataset therefore remain unconfirmed beyond the categories listed.

The real-world impact

Individuals whose email addresses and names were included may receive unsolicited messages or see their details used in attempts to access other accounts where the same email and password combination is reused. Password hashes, if cracked, can facilitate further account takeovers. Dates of birth add a verifiable personal detail that can support identity-verification processes or targeted social-engineering efforts. For the organisation, the incident adds to the body of known exposures associated with its service and may prompt users to review account security settings.

Were you affected?

Readers can check whether their email address appears in known breach datasets through public lookup services. Practical steps include changing passwords on the affected service and any other sites where the same credentials may have been used, and enabling multi-factor authentication where available.

• Review account activity on ShareThis and linked services.
• Replace any reused passwords with unique, strong alternatives.
• Monitor email for unexpected login attempts or password-reset requests.
• Run a free exposure scan of your email address against known breach records.

AICompiled with AI assistance from public sources and published under our editorial standards.