Gravatar 2020 Data Breach: What Was Leaked and Who Was Affected?

In October 2020, Gravatar, a popular service that lets users associate avatars with email addresses for use across a variety of websites, experienced a significant data breach stemming from a large-scale scraping attack. Attackers were able to systematically collect information from the public Gravatar profiles, ending up with nearly 49 million unique records. Much of the data—usernames, full names, profile URLs, locations, and encrypted email identifiers—was later circulated within hacker communities. After various MD5 hashes of users' email addresses were cracked, the breach exposed even more personal details, including email addresses and contact information, raising concerns due to the volume and type of data affected.

How Did the Gravatar Breach Happen?

The breach resulted from automated scraping of Gravatar's public API, which let attackers gather user profile data on a massive scale. Although public profiles were meant to be accessible, attackers leveraged the MD5-hashed email addresses associated with user avatars. Many of these hashes were easily cracked, which revealed corresponding email addresses and helped attackers tie the exposed records to real individuals.

When Did the Breach Take Place?

The breach took place in October 2020, with the scraping operation and subsequent exposure of the collected data happening around the same time. News of the data circulating among hacker circles followed not long after the initial harvesting event.

What Information Was Leaked in the Gravatar Breach?

Nearly 49 million records were exposed in this incident, each consisting of various combinations of information users included in their Gravatar profiles. Data types compromised included:

Usernames
Full names
Profile URLs
Location information (city, state, and zipcode)
MD5 hashes of email addresses (many of which were cracked, revealing the emails themselves)
Other personal identifiers like phone numbers and social-related fields
Hashed passwords in some cases

This aggregation of details could be used to link online identities or target users in phishing attempts.

How Many Users Were Impacted?

A total of 49,279,674 unique user records were included in the breach, representing a substantial portion of Gravatar's user base at the time. Because records often contained email addresses or other identifiers, a wide range of individuals across many websites and services connected to Gravatar were potentially affected.

FAQ About the Gravatar Data Breach

What happened in the Gravatar data breach?

In October 2020, Gravatar had almost 49 million user records scraped from its public-facing profiles, exposing contact and personal information after many hashed emails were decoded.

How many users were affected by the Gravatar data breach?

The breach affected about 49 million unique Gravatar users, with a variety of personal and account-related information compromised.

What personal information was exposed in the Gravatar breach?

Compromised information included usernames, full names, profile URLs, email addresses (after hash cracking), location information, social fields, phone numbers, and hashed passwords.

When did the Gravatar breach occur?

The data breach occurred in October 2020, and details of the leak soon spread within online hacker communities.

How can I check if I'm in the Gravatar breach?

You can check if your information was part of the Gravatar breach by utilizing the DeHashed search engine.