Gravatar, the avatar service used across millions of websites and owned by Automattic, had data on approximately 114 million of its users scraped and distributed within hacking communities in October 2020. A security researcher demonstrated a technique for enumerating Gravatar's public API at scale, harvesting names, usernames, and email address references for around 167 million accounts. The email addresses were stored as MD5 hashes, a format that can be reversed. 114 million of those hashes were cracked, exposing the underlying email addresses alongside the associated profile data. The exposed data included names, usernames, and email addresses. For some users, phone numbers were also tied to their profiles, an unexpected exposure given that Gravatar is primarily thought of as an image-linking service. Because Gravatar is designed to connect a single email address to a profile displayed across many platforms, the scraped dataset can be used to link a person's activity across different sites, including those where they may have used a pseudonym or believed themselves to be anonymous. Gravatar published an FAQ after the incident, characterizing the scraped information as public by design, since the service was built to make profile data accessible across the web. No regulatory action or litigation specific to this incident has been documented. For affected users, the primary risk is identity correlation and targeted phishing. Anyone who used a consistent email address across platforms should be alert to the possibility that their online activity can be linked and their real identity inferred from the aggregated data.

Profile and identity-management services collect emails, usernames, avatar associations, profile metadata, and linked account information used to represent identities across websites.

Gravatar continues to operate as part of the Automattic ecosystem. No major changes to the service have been publicly announced in the recent period. Its integration is embedded across millions of WordPress installations and third-party platforms globally.