Houzz data breach (2018) — what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

What happened

According to public breach records, the Houzz data breach on May 23, 2018 is reported to have exposed the personal information of 48,881,308 accounts.

In mid-2018, the housing design website Houzz suffered a data breach. The company learned of the incident later that year then disclosed it to impacted members in February 2019. Almost 49 million unique email addresses were in the breach alongside names, IP addresses, geographic locations and either salted hashes of passwords or links to social media profiles used to authenticate to the service. The data was provided to HIBP by dehashed.com.

Houzz disclosed in early 2019 that a file of user data was taken by an unauthorized third party. It learned of the incident in late December 2018, with the exposure dating to mid-2018, and around 49 million accounts were affected. The data included names, usernames, emails, IP addresses, IP-derived city and ZIP locations, social-media login links, and salted one-way hashed passwords, but no Social Security numbers or payment or financial data, and Houzz asked affected users to reset passwords.

What data was exposed

The following types of personal data were compromised:

• Email addresses
• Geographic locations
• IP addresses
• Names
• Passwords
• Social media profiles
• Usernames

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by Houzz; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Change your Houzz password and any place you reused it, because the hash algorithm was never disclosed so treat it as crackable. Enable two-factor authentication and use a password manager to stop reuse. Review any Facebook or social logins linked to Houzz, since those profile links were exposed. Watch for phishing emails that use your leaked name and location.