ShopBack Data Breach (2020): What Was Exposed & What To Do

In the current environment of frequent exposures affecting online consumer platforms, incidents involving reward and shopping services highlight ongoing risks to user data. On September 17, 2020, reports indicated that ShopBack, a cashback rewards program, had suffered a data breach that exposed information belonging to 20.5 million users. The incident was documented through data shared with Have I Been Pwned by dehashed.com, confirming the presence of email addresses and associated details. The breach remains one of the larger recorded exposures for a service of this type, underscoring how even established platforms can become vectors for large-scale data movement.

Inside the incident

Public reporting on September 17, 2020, stated that the ShopBack breach had exposed 20.5 million unique email addresses. Additional fields included names, phone numbers, country of residence, and passwords stored as salted SHA-1 hashes. No further technical details on the intrusion method, timeline of access, or volume of files were disclosed in available records.

How a breach like this happens

Incidents affecting online service providers often begin with unauthorised access to customer databases through compromised credentials, unpatched systems, or misconfigured storage. Once inside, attackers can extract structured records containing user identifiers and authentication data. In many cases the data later appears on public or semi-public forums, after which it is aggregated by breach-tracking services.

Who is ShopBack?

ShopBack operates as a cashback rewards platform that connects users with retailers and processes transactions or redemptions. Services of this kind routinely collect account details such as names, contact information, and location data to verify users and deliver rewards. A breach at such a provider is consequential because the records can be repurposed for targeted follow-on activity against a large user base.

What was likely exposed

The records supplied to breach databases listed specific categories of information. Exact confirmation of every field present in the original dataset remains limited to what was shared publicly.

• Email addresses
• Names
• Phone numbers
• Geographic locations (country of residence)
• Passwords stored as salted SHA-1 hashes

The real-world impact

Individuals whose information appeared in the dataset face the possibility of receiving increased volumes of unsolicited messages or attempts to access accounts where the same password or a close variant is reused. For the organisation, the exposure can lead to reputational scrutiny and operational costs associated with notifying users and reviewing security controls. Because the passwords were stored as salted hashes, immediate plaintext recovery is not straightforward, though the hashing method itself is considered outdated by current standards.

What to do if you're exposed

Users should change passwords on the affected account and any other service where the same credential may have been used. Enabling multi-factor authentication where available adds a further layer of protection. Individuals can also run a free exposure scan of their email address through established breach-notification services to determine whether their information has appeared in known datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.