ToonDoo Data Breach (2019): What Was Exposed & What To Do

In August 2019, the comic-strip creation platform ToonDoo experienced a data breach that exposed information belonging to approximately 6 million users. The dataset later appeared on a hacking forum in November of the same year. Public records indicate that the exposed records included email addresses, usernames, IP addresses, genders, geographic locations, and salted password hashes. The incident forms part of a continuing pattern in which online service providers holding user account data become targets for unauthorised access and subsequent redistribution of that data.

Breaking down the breach

The breach was first reported on 21 August 2019. Available information states that the data later surfaced on a popular hacking forum in November, where the records of more than 6 million subscribers were shared. The disclosed fields comprised email addresses, usernames, IP addresses, genders, geographic locations, and salted password hashes. No further technical details about the initial intrusion, such as the method of access or the precise date range of the compromise, have been made public.

How a breach like this happens

Incidents involving online platforms commonly begin with an attacker obtaining unauthorised access to a web application or its supporting infrastructure. Once inside, the attacker may locate and copy user databases or authentication tables. The extracted material is sometimes later posted or traded on forums that specialise in the distribution of stolen records. Salted password hashes, rather than plaintext passwords, are a standard protective measure, yet they remain subject to offline cracking attempts if the hashing algorithm is weak or if attackers possess sufficient computing resources.

ToonDoo and its sector

ToonDoo operated as a web-based service that allowed users to create and share comic strips. Platforms of this type maintain accounts for registered users and therefore store the identifiers and credentials needed for login and content management. Because such services often attract younger audiences and casual creators, the user base can include individuals who may not routinely monitor their online accounts for signs of misuse. A breach at a site holding this category of data can therefore affect people who have limited experience with security practices.

The information in question

The records reported as exposed include email addresses, usernames, IP addresses, genders, geographic locations, and salted password hashes. These data types are consistent with the account information typically retained by an online creative platform. The exact scope of any additional fields that may have been present in the original dataset remains unconfirmed in public reporting.

What's at stake

Exposed email addresses and usernames can be used for targeted phishing or for attempts to access other accounts where the same credentials have been reused. IP addresses and location data may allow inferences about a user’s approximate physical whereabouts. Salted password hashes require computational effort to reverse, but successful cracking would enable direct account access. For the organisation, the redistribution of user records can lead to reputational harm and potential regulatory scrutiny, although the specific consequences in this case have not been detailed publicly.

What to do if you're exposed

Individuals who believe their information may have been included should change the password associated with their ToonDoo account and any other service where the same password was used. Enabling multi-factor authentication on active accounts reduces the risk of unauthorised login even if a password hash is later cracked. Monitoring email accounts for unusual messages and reviewing privacy settings on other platforms can limit secondary misuse of exposed details. Readers may also run a free exposure scan of their email address against known breach datasets to determine whether their information appears in publicly discussed incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.