Wattpad data breach (2020): what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

What happened

Wattpad's June 2020 breach exposed personal data from its storytelling community. Have I Been Pwned (HIBP) lists approximately 268.8 million affected email addresses and added the incident on July 19, 2020. The data was initially sold and later circulated publicly.[1]

That figure describes the breach dataset, not a count of current Wattpad users. This article cannot establish whether a particular person's account was included.

What the sources say about passwords

HIBP describes bcrypt password hashes.[1] BleepingComputer reported seeing both bcrypt and SHA-256 hashes in samples, while noting that it had not independently authenticated the entire database. Its July 20 update reported Wattpad's precautionary password reset.[2] These accounts differ in scope; neither supports treating every exposed password as having the same protection.

What data was exposed

HIBP lists these categories:[1]

• Names, usernames, bios, and genders
• Email addresses and dates of birth
• IP addresses and geographic locations
• Passwords
• Social media profiles and personal website URLs

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your personal data is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by Wattpad; it reflects a publicly reported security incident.

What to do now

1. Replace any still-used affected password. If you have not changed the password used at the time of this breach, change it on Wattpad and anywhere else you reused it. Use a different password for each account.[1]
2. Enable two-factor authentication where supported. Check your email provider and other important accounts for available security settings. This recommendation does not assume Wattpad offers a particular 2FA setting.[1]
3. Treat unexpected messages cautiously. Open the service directly instead of following a password-reset or account-warning link in a message. Familiar personal details do not prove a message is genuine.[3]

For a broader checklist, read what to do in the first 48 hours after a data breach.