Wishbone (2016) Data Breach (2016): What Was Exposed & What To Do

What happened

In August 2016 the Wishbone service, a mobile application that allowed users to compare items, experienced a data breach. The exposed material comprised 9.4 million records containing 2.2 million unique email addresses. Public reporting at the time described the published data as a subset of the complete data set held by the service.

The records included authentication tokens, dates of birth, email addresses, genders, names, phone numbers and usernames. No further technical details about the method of access or the full scope of the data set have been disclosed in available reports.

How a breach like this happens

Incidents involving the exposure of user account data often result from unauthorised access to application databases or backend storage systems. Attackers may exploit software vulnerabilities, obtain valid credentials through other means, or retrieve data that has been inadvertently left accessible. Once obtained, the material can be copied and later distributed or sold.

Authentication tokens are particularly sensitive because they can allow continued access to user accounts without requiring passwords. When such tokens appear alongside contact information, the combination increases the potential for follow-on misuse of the affected accounts.

Who is Wishbone (2016)?

Wishbone operated as a mobile application that let users compare two options on a range of topics. Its user base consisted predominantly of teenagers and young adults, a demographic that often shares personal details when creating accounts on social or entertainment platforms.

Services of this type routinely collect names, contact information, dates of birth and device-linked identifiers to support account creation, notifications and content personalisation. A breach at such an organisation therefore places a younger population in contact with data that can be used for targeted follow-up activity.

What was likely exposed

The published records contained authentication tokens, dates of birth, email addresses, genders, names, phone numbers and usernames. The presence of 9.4 million records with 2.2 million unique email addresses indicates that some addresses appeared multiple times or that additional non-email records were included.

Exact confirmation of every field present in the full original data set remains unavailable. Organisations in this sector commonly store additional profile or usage information, yet no further categories have been verified in connection with this incident.

The real-world impact

Individuals whose email addresses and phone numbers were exposed face an increased likelihood of receiving unsolicited messages or attempts to reset account credentials on other services where the same contact details are used. Authentication tokens, if still valid at the time of exposure, could have permitted direct access to Wishbone accounts.

For the organisation, the incident highlighted the risks associated with storing tokens and personal identifiers without adequate segmentation or encryption. Young users may have limited experience monitoring their online accounts, which can delay detection of any subsequent misuse.

What to do if you're exposed

Anyone who created a Wishbone account should change the password on that service and on any other accounts that share the same password or email address. Enabling two-factor authentication where available reduces the value of exposed tokens or credentials.

Users can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other incidents. Ongoing monitoring of email and phone activity for unexpected messages remains a practical step.

AICompiled with AI assistance from public sources and published under our editorial standards.