Youku data breach: what leaked and what to do
Youku (youku.com) had a data breach on 2016-12-01 affecting 91,890,110 accounts. Passwords were involved.
!Passwords leaked
Added to the catalogue 15 Apr 2017.
What leaked
- Email addresses
- Passwords
What happened
In late 2016, the online Chinese video service Youku suffered a data breach. The incident exposed 92 million unique user accounts and corresponding MD5 password hashes. The data was contributed to Have I Been Pwned courtesy of rip@creep.im.
Description from Have I Been Pwned, in its words.
What to do
- Change the password on that service, and anywhere you used the same password. A password manager makes this painless.
- Turn on two-factor sign-in on that service and on your email.
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
Common questions
What leaked in the Youku breach?
Email addresses, Passwords
When did the Youku breach happen?
The breach date is 2016-12-01; it was added to the public catalogue on 2017-04-15.
What should I do if my staff used this service?
Change the password there and anywhere it was reused, turn on two-factor sign-in, and warn staff about emails quoting the leaked details.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.