Dubsmash, a video messaging and lip-sync app, suffered a data breach in December 2018 that exposed approximately 161 million user records. The breach stemmed from a misconfiguration, allowing direct access to user data. The stolen data was later listed for sale on a dark web marketplace in 2019, bundled alongside databases from several other breached platforms, before circulating more broadly online. The exposed information included email addresses, full names, usernames, phone numbers, geographic locations, spoken languages, and hashed passwords. The passwords were protected using PBKDF2 hashing, which offers some resistance to cracking, but is not unbreakable. The combination of profile details and login credentials creates real risk for affected users, including account takeover, impersonation, and targeted social engineering attacks. Because Dubsmash was a media-linked platform where users built public personas, exposed identities carry additional reputational and targeting risk. Dubsmash notified affected users and required password resets following the breach. No regulatory action or legal settlement specific to this incident has been publicly documented. Reddit acquired Dubsmash in 2020 and shut the platform down in 2022, meaning affected users no longer have an active account to secure. However, anyone who reused their Dubsmash password on other services remains at risk and should change those passwords immediately.

Social video platforms collect user accounts, emails, behavioral data, and user-generated media content.

Dubsmash no longer operates as a standalone platform. Reddit shut it down in February 2022, redirecting users to Reddit's native video features. The breach predates the acquisition and the shutdown.