StarTribune Data Breach (2019): What Was Exposed & What To Do

In October 2019, the Minnesota-based news service StarTribune experienced a data breach that exposed records belonging to 2.2 million individuals. The incident came to public attention when the data appeared for sale on the dark web, and the contents were later supplied to Have I Been Pwned by dehashed.com. The breach involved email addresses, names, usernames, physical addresses, dates of birth, genders, and passwords stored as bcrypt hashes. No further technical details about the intrusion or its timing have been disclosed.

What happened

StarTribune reported the breach on October 10, 2019. The compromised dataset contained more than two million unique email addresses together with the additional fields listed above. The material was subsequently offered for sale on the dark web, after which it was contributed to public breach repositories.

How a breach like this happens

Incidents involving the exposure of subscriber or user records at online services commonly begin with unauthorised access to internal systems that store account information. Attackers may obtain entry through compromised credentials, misconfigured servers, or vulnerabilities in web applications. Once inside, they can copy database tables that hold personal details and authentication data. The stolen material is sometimes packaged and sold on underground forums, after which copies circulate among researchers and data brokers.

StarTribune and its sector

StarTribune is a regional news organisation based in Minnesota that maintains digital subscriptions and accounts for its readers. News outlets routinely collect contact information, demographic details, and login credentials to manage subscriptions, deliver content, and handle billing. A breach at such an organisation can affect a wide cross-section of residents who rely on the service for local reporting, because the records often include stable identifiers such as names and addresses that persist across many other services.

The information in question

The records confirmed as exposed include dates of birth, email addresses, genders, names, passwords stored as bcrypt hashes, physical addresses, and usernames. Exact file counts, internal system descriptions, or additional data categories have not been disclosed. Organisations of this type typically hold subscriber information sufficient to manage accounts and deliver services, yet the precise scope beyond the listed fields remains unconfirmed.

Why it matters

Names, addresses, and dates of birth can be used to build detailed profiles for targeted phishing or identity-related fraud. Hashed passwords, even when stored with bcrypt, may be subject to offline cracking attempts if the hashes are obtained. For readers, the presence of this combination of data increases the chance that accounts at other sites could be targeted if the same credentials or similar patterns are reused. For the organisation, the incident underscores the value of protecting long-term subscriber records that contain stable personal identifiers.

What to do if you're exposed

Review any StarTribune account you maintain and change its password to a unique value. Enable multi-factor authentication on that account and on any other services where the same or similar credentials may have been used. Monitor incoming email and postal mail for unusual activity. Individuals can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.