Swvl Data Breach (2020): What Was Exposed & What To Do

In June 2020 a data breach at the Egyptian mobility company Swvl exposed records belonging to 4.2 million users. The incident was first reported on 23 June 2020 and the data later appeared on multiple online forums before being supplied to Have I Been Pwned by the source breachbase.pw. The event forms part of a continuing pattern in which customer databases from transport and technology services are obtained and redistributed without authorisation.

Inside the incident

The breach affected Swvl, an Egyptian bus operator. Records for 4.2 million individuals were taken and later circulated in online hacking communities. The exposed fields included names, email addresses, phone numbers, profile photos, partial credit card data consisting of card type and the last four digits, and passwords stored as bcrypt hashes. No further technical details on the method or timing of the intrusion have been made public.

How a breach like this happens

Incidents involving the exposure of user account data from online services commonly begin with the compromise of a web application or database server. Attackers may exploit unpatched software, weak authentication controls, or stolen administrative credentials to reach stored records. Once obtained, the data can be copied and shared across forums or marketplaces, after which it often reaches aggregation sites that track breach material.

Who is Swvl?

Swvl operates a technology-enabled bus service primarily in Egypt and other markets in the region. Companies of this type maintain accounts that allow users to book rides, store payment methods, and manage personal profiles. Because these services handle contact details, travel patterns, and payment information, a breach can reveal both operational and personal data at scale.

The information in question

The published facts list the following data elements as exposed: names, email addresses, phone numbers, profile photos, partial credit card data (type and last four digits), and passwords stored as bcrypt hashes. The exact scope of any additional fields or the full contents of the dataset remain unconfirmed beyond these categories.

The real-world impact

Individuals whose information appeared in the dataset face the possibility that their contact details and password hashes could be used in further attempts to access other online accounts. Partial credit card information may assist in targeted fraud attempts, although the absence of full card numbers or CVV values limits its immediate utility. For the organisation, the incident adds to the record of known data losses associated with the service and may prompt regulatory or operational review.

What to do if you're exposed

Users concerned about possible exposure should change passwords on the Swvl service and on any other accounts that reuse the same credentials. Enabling multi-factor authentication where available reduces the value of stolen password hashes. Individuals can also run a free exposure scan of their email address against known breach data to determine whether their information has been included in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.