START Data Breach (2021): What Was Exposed & What To Do

The START data breach involved a Russian streaming service whose subscriber records from 2021 later appeared in public circulation. News of the incident emerged in August 2022, when reports described the exposure of 44 million records that included 7.4 million unique email addresses along with associated country data and password hashes. START confirmed the event in a Telegram post and stated that the material originated in 2021. Approximately 7.5 million individuals were affected according to available reporting.

What happened

The incident concerned records belonging to the streaming platform START. Public reports in August 2022 indicated that 44 million records containing 7.4 million unique email addresses had been exposed. The same records included each subscriber’s country and a password hash. START later acknowledged the incident via Telegram and noted that the data dated to 2021. No further technical details about the intrusion method or the precise date of the original compromise have been released by the company.

How a breach like this happens

Incidents involving subscriber databases at online services often begin with an attacker obtaining access to an internal system through stolen credentials, an unpatched server vulnerability, or a misconfigured database exposed to the internet. Once inside, the attacker can copy tables that store account information. The stolen material is then sometimes posted or sold on forums and leak sites. In many cases the original intrusion occurs months or years before the data surfaces publicly, which matches the timeline reported here.

About START

START operates as a streaming service based in Russia. Like other platforms in this sector, it maintains accounts for paying and registered users. Such services routinely store email addresses, geographic indicators such as country, names, and password data to manage subscriptions and content access. A breach at a streaming provider therefore touches both personal contact details and authentication material, which can be reused across other online accounts.

What was likely exposed

The records that appeared publicly contained email addresses, geographic locations (reported as country), names, and password hashes. The exact scope of additional fields remains unconfirmed beyond the categories already described in reports.

• Email addresses
• Geographic locations (country)
• Names
• Password hashes

Why it matters

Email addresses and password hashes can be used in credential-stuffing attacks against other websites where the same passwords may still be active. Geographic and name data add context that could support targeted phishing or social-engineering attempts. For the organisation, the incident highlights the long-term retention of older subscriber records and the difficulty of containing data once it leaves internal systems.

If your data was in this breach

Change the password associated with your START account and any other service where the same password was used. Enable multi-factor authentication on accounts that support it. Review recent login activity for signs of unauthorised access. Readers can run a free exposure scan of their email address against known breach data to check for further appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.