SongTrivia2 Data Breach (2026): What Was Exposed & What To Do

In April 2026, the music trivia platform SongTrivia2 experienced a data breach that exposed records belonging to approximately 292,000 individuals. The incident came to light when the data set was posted on a public hacking forum, with reports dated April 2, 2026. The material included email addresses obtained through Google OAuth logins or direct site registrations, along with bcrypt password hashes for the latter accounts, as well as names, usernames, avatars, and authentication tokens. The breach is notable because it involved both third-party authentication data and locally stored credentials, raising questions about how user information is protected across integrated login systems.

Breaking down the breach

The available information indicates that the breach affected roughly 292,000 people and resulted in the publication of 291,000 unique email addresses. These addresses originated from either Google OAuth logins or accounts created directly on the platform. The latter group also contained bcrypt password hashes. Additional fields disclosed in the published data set were names, usernames, avatars, and authentication tokens. No further details on the timing or method of the intrusion have been made public.

How a breach like this happens

Incidents involving the exposure of authentication tokens and password hashes often begin with unauthorized access to application servers or databases. Attackers may exploit software vulnerabilities, misconfigured access controls, or compromised credentials to reach stored user records. Once obtained, the data can be packaged and shared on public forums. In cases where OAuth tokens are included, the compromise may extend to integrations with external identity providers, though the precise sequence in any single event remains specific to the environment that was breached.

Who is SongTrivia2?

SongTrivia2 operates as a music trivia platform that allows users to create accounts either directly or through Google OAuth. Organizations in this sector routinely collect identifiers such as email addresses, usernames, and display names to manage accounts and leaderboards. They may also store avatars and session tokens to support ongoing user sessions. A breach at such a service can affect a broad user base because account data is central to participation and personalization features.

The information in question

The published data set contained the following categories of information:

• Auth tokens
• Avatars
• Email addresses
• Names
• Passwords (stored as bcrypt hashes for direct accounts)
• Usernames

Exact confirmation of every record’s contents has not been independently verified beyond the forum posting.

What's at stake

Exposed email addresses and usernames can be used for targeted phishing or account enumeration on other services. Bcrypt-hashed passwords require computational effort to attempt recovery, yet any successful reversal increases the risk of credential reuse elsewhere. Authentication tokens, if still valid, could permit session hijacking until they are revoked or expire. For the organization, the incident may prompt reviews of token storage practices and OAuth integration security.

Were you affected?

Individuals who created accounts on SongTrivia2 or used Google login for the service should monitor their email accounts for unusual activity and consider changing passwords on SongTrivia2 and any other sites where the same credentials may have been used. Enabling multi-factor authentication where available adds a layer of protection. Readers can run a free exposure scan of their email address against known breach data sets to check for appearances in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.