Dubsmash data breach (2018)

In December 2018, the popular video-messaging and lip-sync app Dubsmash suffered a data breach that compromised roughly 162 million user accounts. The incident only became public in February 2019, when the stolen records appeared for sale on the Dream Market dark-web marketplace as part of a sprawling collection peddled by the broker known as GnosticPlayers.

What happened

Dubsmash, founded in Germany and later headquartered in New York, never publicly detailed the intrusion vector. What is known comes from the data itself and from the marketplace listing. The attacker exfiltrated the user database at some point around December 2018 and held it until early 2019, when GnosticPlayers bundled it with data stolen from a long list of other services.

The Dubsmash records were part of the second round of GnosticPlayers' campaign — a combined dump of roughly 620 million accounts spanning sixteen companies, offered for about $20,000 in bitcoin. Dubsmash, at ~162 million records, was the single largest dataset in that batch.

Data exposed

The breach corpus contained:

• Email addresses (161,749,950 unique addresses loaded into Have I Been Pwned)
• Usernames
• Names and, in some records, geographic location and spoken languages
• Phone numbers for a subset of users
• Passwords stored as PBKDF2 hashes

The use of PBKDF2 — a deliberately slow, salted key-derivation function — meant passwords were considerably better protected than the plaintext or unsalted-MD5 stores seen in older mega-breaches. Still, weak passwords remained vulnerable to offline cracking.

Impact and response

Dubsmash did not issue a prominent public breach notice, drawing criticism from security commentators. Users learned of their exposure primarily through Have I Been Pwned notifications. With email-and-password pairs in circulation, the principal risk was credential stuffing against other services where users had reused the same password.

Why it matters

The Dubsmash breach is best understood as one node in the GnosticPlayers phenomenon: a broker who, across several 2019 rounds, listed close to a billion stolen accounts from dozens of companies — including Houzz, MyFitnessPal, MyHeritage, ShareThis and CoffeeMeetsBagel. It illustrated how a single actor could industrialise the resale of breach data, and how consumer apps that collect large user bases become high-value targets regardless of how "trivial" the service appears. The episode also reinforced the value of strong password hashing: PBKDF2 limited the damage relative to peers in the same dumps.