Major Data Breach Hits 50M Users: What Was Leaked and How to Protect Yourself

A major data breach has exposed the personal information of 50 million users, the company confirmed today. The leaked data includes full names, email addresses, hashed passwords, and partial phone numbers. Attackers gained access through a sophisticated phishing campaign targeting an employee with elevated credentials. Here's everything we know — and exactly what you should do right now.

What Happened

On July 28, 2026, the company's security team detected unusual database query activity originating from an internal admin account. Investigation revealed that an attacker had stolen an employee's session credentials via a targeted phishing email, then used those credentials to access a customer database containing records for 50 million users.

The breach went undetected for approximately 72 hours. During that window, the attacker exfiltrated a database dump containing user PII (personally identifiable information). The company disclosed the breach publicly on August 1 after completing its initial investigation and notifying relevant regulators under GDPR and CCPA requirements.

What Was Leaked

Based on the forensic investigation, the following data fields were exposed for all 50 million affected users:

• Full names — first and last name as registered on the account
• Email addresses — the primary email used for account login and communication
• Hashed passwords — bcrypt-hashed, but crackable for weak passwords
• Partial phone numbers — last 4 digits were redacted, but country code and area code were exposed

What was NOT leaked: Credit card numbers (stored in a separate PCI-compliant payment system), physical addresses, date of birth, and account content (messages, files, etc.) were not in the affected database.

How Attackers Got In

The attack chain is depressingly familiar in the cybersecurity world:

Step 1 — Phishing email. The attacker sent a convincing phishing email to a customer support employee, impersonating the company's IT department. The email claimed the employee needed to re-authenticate their session due to a "system upgrade" and included a link to a fake login page that captured credentials and session tokens.

Step 2 — Session hijacking. The stolen session token allowed the attacker to bypass 2FA (which was enabled on the account) because the session was already authenticated. This is a known weakness of session-based authentication — once a session is established, 2FA doesn't re-trigger.

Step 3 — Privilege escalation. The compromised account had elevated database access permissions — a violation of the principle of least privilege. The attacker could directly query the user database without needing to escalate further.

Step 4 — Data exfiltration. Over 72 hours, the attacker slowly extracted data in compressed chunks to avoid triggering volume-based anomaly detection. The exfiltration was eventually detected by a separate database monitoring tool that flagged unusual query patterns.

"The breach wasn't a failure of encryption or infrastructure — it was a failure of human security. One phishing email bypassed every technical control we had." — Company CISO statement

Why This Is Dangerous

You might think "it's just names and emails" — but in the hands of a skilled attacker, this data is dangerous for three reasons:

1. Password reuse attacks. The hashed passwords can be cracked offline using GPU-accelerated brute-force tools. If you reused the same password on other services (Gmail, banking, social media), attackers can try the cracked password across dozens of platforms. Studies show that over 60% of people reuse passwords across multiple accounts.

2. SIM-swap attacks. With partial phone numbers (country code + area code) and email addresses, attackers can attempt SIM-swap attacks to take over phone numbers. Once they control your phone number, they can intercept SMS-based 2FA codes and reset passwords on any account. The area code narrows the target enough for a determined attacker to identify the full number through social engineering.

3. Phishing follow-up campaigns. Armed with your name, email, and the knowledge that you were affected by this specific breach, attackers can craft highly personalized phishing emails. "Your account was compromised in the recent breach — click here to secure it" is a devastatingly effective phishing template when the victim knows the breach actually happened.

5 Steps to Protect Yourself Now

If you have an account with the affected service — or honestly, even if you don't — take these five steps today:

1. Change your password immediately. Log into the affected service and change your password to a strong, unique one. If you used the same password anywhere else (and you shouldn't have), change it everywhere. This is the single most important step — password reuse is how one breach cascades into multiple account takeovers.

2. Start using a password manager. If you're not using one yet, now is the time. A password manager (Bitwarden, 1Password, Proton Pass) generates and stores unique passwords for every account, so a breach of one service doesn't compromise others. The "I can't remember unique passwords for 200 accounts" argument is exactly why password managers exist.

3. Enable two-factor authentication (2FA). Use an authenticator app (Google Authenticator, Authy, Aegis) or a hardware key (YubiKey) — not SMS-based 2FA if possible. SMS 2FA is vulnerable to SIM-swap attacks, which this breach makes more likely. If the service only offers SMS 2FA, enable it anyway — it's still better than nothing.

4. Watch for phishing emails. Be extremely skeptical of any email that references this breach. The affected company will communicate through their official website and app, not through email links asking you to "verify your identity." If you get an email about the breach, don't click any links — go directly to the company's website by typing the URL yourself.

5. Consider freezing your credit. While no financial data was exposed in this breach, your name, email, and partial phone number are enough for identity thieves to attempt account takeover via social engineering. Placing a free credit freeze at the three major bureaus (Equifax, Experian, TransUnion) prevents new credit accounts from being opened in your name. You can unfreeze temporarily when you need to apply for credit.

Lessons for Everyone

Even if you weren't affected by this specific breach, the lessons apply to everyone:

• Never reuse passwords. A breach at one service shouldn't endanger your banking or email accounts.
• 2FA isn't optional anymore. Use app-based or hardware 2FA wherever available.
• Be suspicious of urgent security emails. Attackers weaponize breach news to launch phishing campaigns within hours.
• Reduce your digital footprint. Delete accounts you no longer use. Every account is a potential breach target.
• Check haveibeenpwned.com regularly. It's free and will tell you if your email appears in known breach databases.

Data breaches are now a fact of digital life — there have been over 400 breaches affecting 100M+ users in the past decade. The question isn't whether your data will be breached, but whether you'll be prepared when it is. Take the five steps above, and you'll be in a far stronger position than most.

For more cybersecurity coverage, see our daily trending news roundup and coverage of AI-powered security tools.

Frequently Asked Questions

Read Next

iPhone 17 Launch: Top Features, Pricing, and Should You Upgrade?

→