Houzz Data Breach
The Houzz data incident occurred in mid-2018 and was confirmed after Houzz learned in late December 2018 that a third party possessed a user-data file.
Exposed Data Types
7- Email addresses
- Geographic locations
- IP addresses
- Names
- Passwords
- Social media profiles
- Usernames
About This Breach
A public breach source reports 48,881,308 unique email addresses and the collection-level classes names, usernames, IP addresses, geographic locations, password hashes, and social profiles. May 23, 2018 is a catalogue date, not a confirmed exact access, acquisition, or discovery day.
According to Houzz, the file could include profile fields a user had made public, internal identifiers, email, user ID, previous and current usernames, a uniquely salted one-way password hash, IP-derived city or ZIP, and a public Facebook ID where Facebook login was used. Fields varied by person; a password hash and social-login link should not be assumed present in every record. IP-derived location is not a home address or current location, and a hash is not a plaintext password.
No Houzz data has been imported into local search. This record cannot produce a positive or negative person-level result and does not identify anyone as a homeowner, design professional, architect, contractor, Houzz user, or Facebook account holder. Profile content, location, password ownership, field co-occurrence, and misuse cannot be inferred. Houzz said Social Security numbers and financial information were not in the file; absence of other unlisted fields is not universal proof that no source variant contained them.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
