Ulmon Data Breach (2020): What Was Exposed & What To Do

The incident was reported on 26 January 2020. Public information confirms the presence of names, passwords stored as bcrypt hashes, and, in certain records, social media profile identifiers, telephone numbers and biographical text. No further details on the method of access or the precise timeline of the intrusion have been disclosed.

What happened

Records show that Ulmon held approximately 1.3 million entries at the time of the incident. Of these, 777,000 contained unique email addresses. Passwords were stored using the bcrypt hashing algorithm. A subset of the records also included names, social media profile identifiers, telephone numbers and biographical information. The data set was subsequently posted to a popular hacking forum.

How a breach like this happens

Incidents involving the exposure of user databases often begin with unauthorised access to an organisation’s servers or applications. Attackers may exploit vulnerabilities in software, obtain valid credentials through other means, or take advantage of misconfigured storage systems. Once inside, they can copy large volumes of records and later distribute them on public forums or other channels. The exact sequence in any single case remains unknown unless the organisation publishes a technical report.

Ulmon and its sector

Ulmon develops a travel application used by individuals to plan and manage journeys. Companies in this sector routinely collect account information to provide mapping, routing and location-based services. A breach at such a service can therefore affect users who have supplied contact details and authentication data in exchange for those features.

The information in question

The exposed records included email addresses, names and passwords stored as bcrypt hashes. Some entries also contained telephone numbers, social media profile identifiers and biographical text. The precise combination of fields varied across the data set, and the full scope of every record remains unconfirmed beyond the categories already reported.

What's at stake

Individuals whose email addresses and hashed passwords appeared in the data face the possibility that the hashes could be tested against known password lists over time. Telephone numbers and social media identifiers can be used for targeted contact or to link accounts across platforms. The organisation itself may face regulatory scrutiny and costs associated with notifying users and improving security controls.

If your data was in this breach

Anyone who used the Ulmon service around the time of the incident should change the password associated with their account and avoid reusing that password elsewhere. Enabling multi-factor authentication on linked services reduces the value of any exposed credentials. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.