Thingiverse Data Breach (2020): What Was Exposed & What To Do

In the current threat landscape, where copies of service databases regularly appear in unauthorized online spaces long after initial collection, an incident at the 3D model platform Thingiverse has drawn attention. A 36GB backup file containing records for 228,000 users began circulating within hacking communities in October 2021, with the underlying data originating from October 2020. MakerBot, the owner of Thingiverse, has acknowledged awareness of the incident but has not issued a public disclosure statement. The exposure underscores how even specialized online services can become vectors for the redistribution of user information without timely notification to those affected.

What happened

A database backup taken from Thingiverse began circulating extensively in October 2021. The file dates to October 2020 and holds 228,000 unique email addresses, along with usernames, IP addresses, full names, and passwords stored as unsalted SHA-1 or bcrypt hashes. In some cases, physical addresses were also present. The incident was reported on October 13, 2020. No further details on the method of acquisition or exact scale beyond the stated record count have been disclosed.

How a breach like this happens

Incidents involving the circulation of database backups often begin with unauthorized access to a service's storage systems, whether through compromised credentials, misconfigured servers, or supply-chain weaknesses. Once obtained, the data may be retained for months or years before appearing on forums or file-sharing sites. Organizations that store user comments, account details, and authentication tokens in a single backup file increase the volume of information that can be redistributed if the file leaves their control.

Who is Thingiverse?

Thingiverse operates as a public repository for 3D-printable models, allowing users to upload, comment on, and download designs. As a platform in the maker and additive-manufacturing sector, it collects account information, contact details, and activity logs to support user interaction and content moderation. A breach at such a service is consequential because participants often include hobbyists, educators, and small businesses whose physical addresses or device identifiers may appear alongside their online activity.

What was likely exposed

The circulating backup is reported to contain the following categories of information:

• Dates of birth
• Email addresses
• IP addresses
• Names
• Passwords (stored as unsalted SHA-1 or bcrypt hashes)
• Physical addresses (in some cases)
• Usernames

Exact confirmation of every record and the presence of additional fields remain unconfirmed pending further statements from the organization.

Why it matters

Individuals whose information appears in the data face the possibility of targeted phishing, account takeover attempts on other services where the same credentials were reused, and unsolicited contact at disclosed physical addresses. For the organization, the absence of a formal disclosure statement limits users' ability to take timely protective measures and may affect trust in platforms that store both digital and real-world identifiers.

What to do if you're exposed

Review any Thingiverse account for unauthorized activity and change the password if reuse occurred elsewhere. Enable multi-factor authentication on linked services and monitor incoming email for unusual messages. Readers can run a free exposure scan of their email address to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.