Tout Data Breach (2014): What Was Exposed & What To Do

In September 2014 the social networking service Tout suffered a data breach that exposed records belonging to approximately 653,000 users. The incident was first reported on 11 September 2014; the data later resurfaced in public repositories years afterward.

The breach is notable because Tout has since ceased operations, yet the records continue to circulate. The available information indicates that the exposed material included email addresses, names, usernames, geographic locations, user bios, IP addresses and passwords stored as bcrypt hashes.

Breaking down the breach

Public records place the compromise in approximately September 2014. The dataset that later appeared contained 653,000 unique email addresses together with associated names, usernames, IP addresses, geographic locations, bios and bcrypt-hashed passwords. No further technical details about the intrusion method, duration or volume of files removed have been disclosed in the available reporting.

How a breach like this happens

Incidents affecting online services commonly begin with the exploitation of unpatched software, weak authentication controls or stolen administrative credentials. Once inside the network, an attacker may locate databases that store user account information and copy portions of those records. In many cases the stolen data are later posted or sold on forums and leak sites, sometimes years after the original intrusion.

Tout and its sector

Tout operated as a short-form video and social networking platform that allowed users to create profiles, share location-tagged content and maintain biographical information. Services of this type routinely collect contact details, device identifiers and authentication data to support account creation and content personalisation. Because Tout is now defunct, responsibility for ongoing security or user notification rests with whatever entity may still hold residual assets.

The information in question

The records that have surfaced include email addresses, names, usernames, geographic locations, bios, IP addresses and passwords stored as bcrypt hashes. The exact scope of any additional fields that may have been taken remains unconfirmed. Bcrypt hashing indicates that passwords were not stored in plain text, though the strength of individual passwords still determines how readily they can be recovered.

The real-world impact

Individuals whose information appears in the dataset face the possibility that their email addresses and usernames will be used for targeted phishing or that reused passwords will be tested against other accounts. IP addresses and location data can reveal approximate places of access at the time of the breach. For the organisation, the incident adds to a public record of a now-defunct service whose user data continue to circulate without active remediation.

What to do if you're exposed

Anyone who used Tout should change passwords on any other sites where the same credentials were reused and enable multi-factor authentication where available. Monitoring email accounts for unexpected login attempts or unsolicited messages provides an early indication of misuse. Readers can also run a free exposure scan of their email address against known breach data to determine whether their information has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.