Dailymotion data breach (2016) — what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

What happened

According to public breach records, the Dailymotion data breach on October 20, 2016 is reported to have exposed the personal information of 85,176,234 accounts.

In October 2016, the video sharing platform Dailymotion suffered a data breach. The attack led to the exposure of more than 85 million user accounts and included email addresses, usernames and bcrypt hashes of passwords.

Passwords in this breach were reportedly stored as bcrypt hashes.

In December 2016, the breach-notification service LeakedSource reported that video-sharing site Dailymotion had been breached around October 20, 2016, exposing roughly 85 million user accounts (about 87.6 million records). Exposed data included email addresses and usernames for the full set, plus bcrypt-hashed passwords (10 rounds of rekeying) for approximately 18 million of those accounts. The bcrypt hashing was notable because it made the passwords costly to crack — so the primary near-term exposure was email addresses and usernames rather than usable plaintext passwords.

What data was exposed

The following types of personal data were compromised:

• Email addresses
• Passwords
• Usernames

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by Dailymotion; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Change your Dailymotion password, and change it anywhere you reused the same password — the leaked passwords were hashed but reuse remains the main risk.
• Turn on two-factor authentication on Dailymotion and on any account that shares that email/password combination.
• Treat the exposed email address as a phishing and spam target: be wary of unsolicited messages referencing Dailymotion or asking you to 'verify' your account.
• Use a password manager to set a unique password per site so a future credential leak can't unlock your other accounts.