Omaze Alleged Data Exposure
The 2020 Omaze data breach occurred in July 2020 when production AWS RDS MySQL database dumps belonging to Omaze (omaze.com), the prominent American online fundraising and sweepstakes platform, were exfiltrated and leaked online.
Exposed Data Types
6- Email addresses
- Names
- Geographic locations
- Genders
- Purchases
- Passwords
About This Record
What information was compromised in the Omaze incident?
The leaked dataset comprises primary user tables and WordPress user accounts (omaze_users.sql and omaze_wpusers.sql). Compromised data classes include:
- Donor Contact Coordinates: Validated user email addresses (email, user_email), usernames (user_login), and display names.
- Personal Identifiers: First and last names, self-reported genders, and postal/ZIP codes.
- Platform Transactions: Order sequence identifiers (first_order_id), registration timestamps, and marketing preference flags.
- Authentication Secrets: WordPress phpass password hashes (user_pass).
How many accounts were affected?
Rigorous RFC 5322 ASCII canonical processing confirmed 2,794,460 unique valid email addresses across 3.34 million total raw records.
Security analysis and advisory
The disclosure of donor names, locations, and sweepstakes participation history creates significant exposure to targeted charity fraud, fraudulent lottery notification scams, and credential stuffing. Impacted users should:
- Update their Omaze passwords and any identical credentials reused elsewhere.
- Beware of unsolicited communications alleging sweepstakes wins or requesting tax/processing fees for claimed prizes.
- Employ unique, high-entropy passwords managed via dedicated credential vaults.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
