[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2drd25japxce1":3},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":9,"domain":10,"breachDate":11,"addedDate":12,"modifiedDate":12,"contentUpdatedAt":13,"source":14,"sourceUrl":15,"sourceUrls":16,"pwnCount":21,"affectedCount":21,"affectedCountStatus":22,"affectedCountLowerBound":23,"affectedCountUnit":24,"hasEnglishDescription":4,"severity":25,"dataClasses":26,"description":42,"seoTitle":43,"seoTitleEn":44,"seoDescription":43,"seoDescriptionEn":45,"logoUrl":46,"isVerified":4,"isSensitive":47,"isSpamList":47,"isMalware":47,"company":48},"68e3266eda11adda488250d4","AIType","ai.type Data Breach","aitype","aitype.com","2017-12-05T00:00:00.000Z","2017-12-08T21:31:25.000Z","2026-07-19T18:49:01.447Z","Verified data exposure","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20171205153816\u002Fhttps:\u002F\u002Fmackeepersecurity.com\u002Fpost\u002Fvirtual-keyboard-developer-leaked-31-million-of-client-records",[15,17,18,19,20],"https:\u002F\u002Fwww.bbc.co.uk\u002Fnews\u002Ftechnology-42238574","https:\u002F\u002Fplay.google.com\u002Fstore\u002Fapps\u002Fdetails?id=com.aitype.android.p&hl=en_US&gl=US","https:\u002F\u002Faitype.com\u002F","https:\u002F\u002Fplay-lh.googleusercontent.com\u002FpY6DV_LNiTR_9QUOfPeVtkTV7R_tt9X9zJi71Xd7ZSJxc8Tx3TjuzcL_iVANYP3OSddiy5p0l_Ox_ts9cYBi5rA=w240-h480-rw",20580060,"known",null,"unknown","Critical",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"Address book contacts","Apps installed on devices","Cellular network names","Dates of birth","Device information","Email addresses","Genders","Geographic locations","IMEI numbers","IMSI numbers","IP addresses","Names","Phone numbers","Profile photos","Social media profiles","\u003Cp>\u003Cstrong>The ai.type data breach\u003C\u002Fstrong> affected 20,580,060 email accounts through a database left publicly accessible in December 2017.\u003C\u002Fp>\u003Ch2>Types of Exposed Data and Risks\u003C\u002Fh2>\u003Cp>The ai.type virtual-keyboard dataset contained address-book contacts, installed apps, cellular network names, dates of birth, device information, email addresses, genders, geographic locations, IMEI and IMSI numbers, IP addresses, names, phone numbers, profile photos and social media profiles. Address-book records may affect both app users and third parties saved in their contacts. Passwords, payment cards and financial information are not confirmed classes. Researchers reported IMEI and coordinate fields, while the company disputed them; their accuracy and completeness for every user should not be assumed. Names, phone numbers, photos and social profiles can make personalised scams more convincing. Device, network, IP and installed-app details can expose the target’s technical environment and help an attacker choose a relevant service or software weakness.\u003C\u002Fp>\u003Ch2>Breach Timeline and Technical Details\u003C\u002Fh2>\u003Cp>On 5 December 2017, researchers reported that an ai.type database measuring about 577GB was reachable from the internet without authentication. The review described 31,293,959 client-registration rows, 6,435,813 address-book records with more than 373 million contact entries, and 753,456 rows in an older folder. These are different grains and must not be added to produce a person count. The 20,580,060 figure on this page is the canonical count of unique email addresses; address-book contacts are not added to the global account total. The company said the secondary database had been shut down, but the exposure duration and third-party downloads remain unknown. Evidence points to a misconfigured public store rather than an intrusion that defeated a password, yet possible unauthorised access makes it a data breach for users.\u003C\u002Fp>\u003Ch2>User Groups at Risk\u003C\u002Fh2>\u003Cp>People who installed ai.type on Android or iOS before the 2017 discovery and granted access to contacts, device data or social accounts are the primary risk group. Someone who never installed it may still be indirectly affected if an ai.type user stored that person’s name and phone number. An email, phone number, birth date, photo and social profile in one record can strengthen fake support calls, account-recovery scams and targeted phishing. IMSI or network details may support mobile-carrier impersonation, although disputed fields should not be assumed in every record. Installed-app and device-model information can help select services to target. An email match does not mean every class was populated for that person. Practical risk depends on record completeness and whether the exposed details remain current today.\u003C\u002Fp>\u003Ch2>Immediate Steps to Take\u003C\u002Fh2>\u003Cp>\u003Cstrong>If you used ai.type, review its device permissions, connected accounts and unfamiliar sessions immediately.\u003C\u002Fstrong> Remove it if no longer needed; otherwise keep the official-store version current and restrict contacts, location and other permissions. Enable multi-factor authentication on primary email and social accounts, verify recovery addresses and phone numbers, and close sessions you do not recognise. Passwords are not a confirmed class, so change weak or reused credentials and accounts showing suspicious login or reset activity rather than assuming every password leaked. Add a PIN to your mobile-carrier account to reduce number-porting and SIM-swap risk. If a caller knows your device, phone or social profile, contact the organisation through a channel you find independently. Never disclose an IMEI, IMSI or one-time code to an unsolicited caller or message.\u003C\u002Fp>\u003Ch2>Long-Term Security Strategies\u003C\u002Fh2>\u003Cp>Virtual keyboards operate close to typed content and core device functions, so examine the developer, permissions and data-handling claims carefully. Ask why a keyboard needs contacts, location or a persistent device identifier; deny unnecessary access and remove unused keyboards in system settings. Keep the operating system and apps updated, install software only from official stores, and review permissions after major updates. Unique passwords plus an authenticator app or security key limit account-recovery attacks built from exposed personal details even though passwords were not present here. Reduce birth-date and phone visibility on social profiles and avoid public facts in recovery questions. Current privacy declarations do not retroactively change the verified 2017 exposure. Breach monitoring and account alerts can warn if old identity or contact data is reused years later.\u003C\u002Fp>\u003Ch2>Check Your Data\u003C\u002Fh2>\u003Cp>\u003Cstrong>Check your email address with LeakData\u003C\u002Fstrong> to see whether it matches ai.type or another verified breach. A match places the address among the canonical 20,580,060 email accounts; it does not mean all raw client rows or hundreds of millions of contact entries belong to you. Nor does it prove that every device identifier or phone contact was exposed. Use the date and classes to prioritise device permissions, email security, social accounts and mobile-carrier protection. Never enter a password, phone number, IMEI or IMSI into the search field; an email address is sufficient. Ongoing monitoring can flag datasets published later. Keep recovery settings current because old email, phone and social-profile links may remain useful for years.\u003C\u002Fp>","","ai.type Data Breach (20.6 Million Reported Records)","ai.type Data Breach. 20.6 Million reported records were reported. Reported data: Address book contacts, Apps installed on devices, Cellular network names…","\u002Fuploads\u002Flogo\u002Faitype-official.webp",false,{"name":49,"sector":50,"country":51,"website":10,"websiteArchiveUrl":43,"websiteStatus":43,"websiteCheckedAt":23},"ai.type","Technology","Israel"]