iMesh data breach (2013) — what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

What happened

According to public breach records, the iMesh data breach on September 22, 2013 is reported to have exposed the personal information of 49,467,477 accounts.

In September 2013, the media and file sharing client known as iMesh was hacked and approximately 50M accounts were exposed. The data was later put up for sale on a dark market website in mid-2016 and included email and IP addresses, usernames and salted MD5 hashes.

Passwords in this breach were reportedly stored as MD5 hashes.

iMesh, a media and peer-to-peer file-sharing service, had its user database compromised in September 2013, but the breach only surfaced in mid-2016 when LeakedSource obtained the data and it was offered for sale on a dark-web marketplace for about 1 bitcoin. The dump exposed roughly 49-51 million accounts, each containing an email address, username, IP address, and a password stored as a salted MD5 hash — a weak algorithm that is now easy to crack. Analysis of the recovered passwords showed extremely common choices such as "12345" (used by nearly a million accounts), underscoring how readily the credentials could be reused against other sites.

What data was exposed

The following types of personal data were compromised:

• Email addresses
• IP addresses
• Passwords
• Usernames

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by iMesh; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Change your iMesh password and immediately update it anywhere you reused it — the passwords were only salted MD5 hashes, which are crackable into plaintext.
• Enable two-factor authentication on your email and any accounts that shared this password, since exposed email-plus-password pairs fuel credential-stuffing attacks.
• Be alert for targeted phishing emails referencing old accounts, as your email address and username were exposed and can be used to make scams look legitimate.
• Use a password manager to set a unique password per site so a single old leak like this can never unlock your other accounts.