ShareThis, a data and marketing technology company whose sharing buttons appear on millions of websites, suffered a breach in July 2018 that exposed records on approximately 41 million individuals. The company operates not just as a social sharing tool but as an audience data platform, collecting and selling behavioral data gathered through its widespread web presence. The breach pathway involved a misconfiguration, and the exposed data surfaced for sale on dark web marketplaces in 2019 before circulating more broadly. The exposed records included email addresses, names, dates of birth, and in some cases password hashes. Because ShareThis functions as a data broker rather than a consumer-facing service, most affected individuals had no direct relationship with the company and likely had no knowledge their information was held there. This makes the breach particularly concerning: people cannot protect data they do not know has been collected about them. The combination of behavioral tracking data with personal identifiers creates real risk of cross-site profiling, phishing, and targeted manipulation. No prominent regulatory action or settlement specific to this breach has been documented. ShareThis notified relevant parties and brought in cybersecurity investigators following the incident. For affected individuals, the practical risks include credential stuffing attacks if password hashes are cracked, as well as phishing campaigns built on the detailed profiles this data can enable. Anyone who may have used a site featuring ShareThis widgets should consider changing passwords used around that period, particularly if the same credentials were reused elsewhere.

Adtech and tracking platforms collect cross-site behavioral data, device identifiers, browsing activity, and engagement signals to enable targeted advertising and analytics across the web.

ShareThis continues to operate as a marketing data company. The company has navigated increasing scrutiny of third-party tracking and cookie-based data collection as browsers and regulators have moved to restrict such practices. No major organizational changes beyond this industry context have been prominently reported.