Evite data breach (2013)

On 11 August 2013, the social-planning website Evite — used to send and manage online event invitations — held customer data in an archive that would, six years later, become one of the largest consumer breaches surfaced through Have I Been Pwned. In April 2019, Evite discovered that an unauthorised third party had accessed an inactive database archive dating back to 2013, exposing roughly 101 million unique accounts.

What happened

According to Evite's own disclosure, an unauthorised party acquired an inactive data-storage file on 22 February 2019. The file contained dated user records from 2013 and earlier — information from accounts that were no longer active but had never been purged. Evite identified the unauthorised access during an internal investigation in April 2019 and posted a data-incident notice the following month.

The breach drew wider attention when a threat actor began advertising an Evite database for sale on a dark-web marketplace. Initial estimates put the exposure at around 10 million records, but in July 2019 a far larger dataset — 100,985,047 unique email addresses — was loaded into Have I Been Pwned, revealing the true scope.

Impact

• Roughly 101 million unique email addresses were exposed, most belonging to recipients of invitations rather than registered account holders.
• Compromised data classes included names, email addresses, phone numbers, physical addresses, dates of birth, genders and passwords.
• Critically, the passwords were stored in plain text, meaning no cracking was required to use them — a serious risk for anyone who reused those credentials elsewhere.
• Evite stated that no financial information or Social Security numbers were involved.

Why it matters

The Evite breach is a textbook case of the risk of forgotten legacy data. The exposed information sat in an inactive archive that served no operational purpose, yet remained accessible and unencrypted long after the accounts behind it went dormant. Had the records been deleted or properly secured under a data-retention policy, the incident would have been far smaller — or impossible.

It also underscores why plaintext password storage remains indefensible: a single archive compromise handed attackers directly usable credentials for 101 million users, many of whom likely reused those passwords on other services. The case is frequently cited alongside data-minimisation and retention requirements now embedded in privacy regimes such as the GDPR and California's CCPA.