Evite Event Invitation Platform Breach (2019): 36 Million User Accounts Including Passwords, DOB & Home Address Exposed

About Evite

Evite is an online invitation and event planning platform that allows users to create, send, and manage digital invitations for personal events, parties, and gatherings. Founded in 1998, it is one of the earliest consumer internet services still in operation. The platform operates on a freemium model with premium invitation designs and event management tools. It has changed ownership multiple times through its history and serves primarily the U.S. consumer market.

Why They Hold Your Data

Digital invitation platforms collect organizer and guest identity, emails, event details, contact lists, RSVP status, and event-planning records tied to social gatherings and celebrations.

Recent Developments

Evite continues to operate as a consumer event planning tool under private ownership. The platform has navigated competition from social media event features and specialized event management apps. No major organizational changes have been prominently reported in the recent period.

Data Points Exposed

Breach Impact

In 2019 Evite disclosed a data breach in which an unauthorized party accessed inactive user data stored since 2013. The exposed records covered over 100 million users and included email addresses, usernames, passwords, dates of birth, phone numbers, physical addresses, and genders. A security researcher discovered the dataset for sale on a dark web marketplace and notified Evite. The company notified affected users and prompted password resets. No class-action settlement or regulatory enforcement action specific to this incident has been prominently documented in public sources.

Exploitation & Downstream Threats

• Credential stuffing against reused passwords across other platforms | • Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Reset any reused passwords and enable MFA on email first, then financial accounts.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).