TheTVDB.com Data Breach (2017): What Was Exposed & What To Do

What happened

In November 2017, TheTVDB.com suffered a data breach. The breached data was posted to a hacking forum and included 182k records with usernames, email addresses and MySQL password hashes. The incident was reported on November 21, 2017. No further details on the timing, method of access, or total scope beyond the posted records have been disclosed.

How a breach like this happens

Incidents involving the exposure of usernames, email addresses, and password hashes often begin with an attacker gaining unauthorised access to a web application's database. This can occur through vulnerabilities in the site code, weak authentication controls, or compromised administrative credentials. Once inside, the attacker can extract user tables and later publish the contents on public forums. Passwords stored only as hashes limit immediate misuse, but the combination of email addresses and usernames still allows attackers to test the same credentials on other services.

Who is TheTVDB.com?

TheTVDB.com operates as an open database for television programme metadata. Users contribute and maintain information such as episode titles, air dates, and cast details. Like many community-driven sites, it stores basic account information to manage contributions and logins. A breach at such a service is consequential because the exposed email addresses can be used for targeted phishing and because password hashes may be cracked offline if they were created with older or weak hashing methods.

The information in question

The records posted after the breach contained usernames, email addresses, and MySQL password hashes. The exact contents of the full dataset remain unconfirmed beyond what was shared publicly. Organisations of this type typically hold only the data required for user accounts and contribution tracking; no evidence has been presented that additional categories such as payment details or viewing histories were involved.

What's at stake

For affected individuals, the primary risks are credential stuffing on other websites and phishing emails that reference their TheTVDB.com account. If a person used the same password elsewhere, an attacker who cracks the hash could attempt access to unrelated services. For the organisation, the incident highlights the long-term value of user account data even when no financial information is present.

What to do if you're exposed

Anyone who suspects their information may have been included should change the password on TheTVDB.com if the account is still active and review passwords on any other sites where the same credentials were used. Enabling two-factor authentication wherever possible adds a further layer of protection. Readers can run a free exposure scan of their email address to check whether their information has surfaced in known breach data.

• Change the password associated with the affected account.
• Check for reuse of the same password on other services.
• Enable two-factor authentication on important accounts.
• Monitor email for unusual login attempts or phishing messages.

AICompiled with AI assistance from public sources and published under our editorial standards.