Havenly Data Breach

BleepingComputer reported seeing login names, full names, emails, phones, ZIP codes, site-usage data, and MD5-hashed passwords in a sample. Havenly was contacted on July 27, 2020 and five days later logged out customers, required password resets, and issued notifications. The company said it did not store complete card numbers, although the last four digits may have appeared in some records.

A public breach source instead reports 1,369,180 unique emails under a June 25 catalogue date and a narrower field list that includes SHA-1 password hashes. The MD5 and SHA-1 claims conflict; no single algorithm should be treated as established until the raw password columns are authenticated. The 1,369,180 figure is a unique-email measure, not people or raw rows, and June 25 is not proven to be the exact attack date.

The two-part local import processed 1,362,325 email lines and produced 1,362,324 unique email associations in the live index, 6,856 below a public breach source's measure. Passwords, login names, phones, locations, usage data, and card fragments are not locally searchable. Missing source files and the one-line processing-to-index difference remain unreconciled.

A private result can establish only that the controlled email occurs in the local email subset attributed to Havenly. It cannot establish identity, account or customer ownership, design-service or purchase interest, home or location details, a password, field co-occurrence, compromise, or misuse. Havenly's forced reset should have invalidated the Havenly password; only people who reused a recovered old password elsewhere should replace it there.