Wishbone (2020) Data Breach (2020): What Was Exposed & What To Do

What is known is that a data incident affecting the Wishbone mobile app was reported on 27 January 2020 and involved records for 9.7 million individuals. The exposure included email addresses, names, passwords stored as unsalted MD5 hashes, and several other categories of personal information. Because the same service had already experienced a breach in 2016, the 2020 incident renewed questions about how user data was stored and protected. The practical stakes are straightforward for anyone who created an account: email addresses and passwords that can be tested against other services, together with dates of birth and location data that can be used to support account takeover or targeted phishing.

What happened

Public reports state that an extensive set of Wishbone user records appeared online in January 2020 and was subsequently redistributed. The material contained 9.7 million unique email addresses along with names, phone numbers, geographic locations and additional personal attributes. Passwords were present in unsalted MD5 format. The incident was described as a second breach for the service, following an earlier event in 2016. No further technical details about the method of access or the period during which data was obtained have been disclosed in available reporting.

How a breach like this happens

Incidents involving the disclosure of user databases commonly begin with an attacker obtaining unauthorised access to an application’s backend systems. Once inside, the attacker can copy tables that store account credentials and profile information. When passwords are stored with weak or absent hashing, the copied data becomes immediately usable for attempts to access other online accounts. After extraction, the material is frequently posted to public or semi-public locations and then copied by multiple parties, increasing the chance that it will remain available even if the original posting is removed.

Wishbone (2020) and its sector

Wishbone operated as a mobile application that allowed users to compare items, opinions or preferences. Services of this type collect and retain account identifiers, contact details and activity-related attributes to support user profiles and social features. A breach at such an application is consequential because the data it holds is often reusable across other platforms; email addresses and passwords, in particular, can be tested against unrelated services that users may have accessed with the same credentials.

The information in question

The records reported as exposed include auth tokens, dates of birth, email addresses, genders, geographic locations, IP addresses, names and passwords. The exact scope of every field present in the dataset remains unconfirmed beyond these categories. Organisations that operate comparison or social apps routinely store profile and authentication data of this kind, yet the precise contents of the 2020 Wishbone release have not been independently verified in detail.

The real-world impact

For individuals, the presence of email addresses and unsalted password hashes raises the possibility that credentials could be tested against other online services. Dates of birth, locations and names can support more convincing social-engineering attempts. For the organisation, the incident added to an existing record of prior exposure, potentially affecting user trust and prompting reviews of data-storage practices. No confirmed instances of subsequent fraud tied directly to this dataset have been documented in public reporting.

What to do if you're exposed

Anyone who used the Wishbone app can take several immediate steps to limit further risk.

• Change the password on the Wishbone account and on any other service that used the same or a similar password.
• Enable multi-factor authentication wherever it is available, especially on email and financial accounts.
• Monitor incoming email for unusual login alerts or password-reset messages.
• Run a free exposure scan of your email address against known breach data to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.