Gravatar 2020 Data Breach
Platform · Avatar and identity services · Profile and identity management service · Global
Gravatar Avatar Service API Scrape (2020): 49 Million User Profiles Including Names & Phone Numbers Enumerated
Global avatar service linked to email identities.
Scrape · ObscureIQ Intelligence
Breach Risk Index i
41/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
49.7MRecords
2020Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
Gravatar, the avatar service used across millions of websites and owned by Automattic, had data on approximately 114 million of its users scraped and distributed within hacking communities in October 2020. A security researcher demonstrated a technique for enumerating Gravatar's public API at scale, harvesting names, usernames, and email address references for around 167 million accounts. The email addresses were stored as MD5 hashes, a format that can be reversed. 114 million of those hashes were cracked, exposing the underlying email addresses alongside the associated profile data. The exposed data included names, usernames, and email addresses. For some users, phone numbers were also tied to their profiles, an unexpected exposure given that Gravatar is primarily thought of as an image-linking service. Because Gravatar is designed to connect a single email address to a profile displayed across many platforms, the scraped dataset can be used to link a person's activity across different sites, including those where they may have used a pseudonym or believed themselves to be anonymous. Gravatar published an FAQ after the incident, characterizing the scraped information as public by design, since the service was built to make profile data accessible across the web. No regulatory action or litigation specific to this incident has been documented. For affected users, the primary risk is identity correlation and targeted phishing. Anyone who used a consistent email address across platforms should be alert to the possibility that their online activity can be linked and their real identity inferred from the aggregated data.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
49.7M records analyzed
About Gravatar
Gravatar is a globally recognized avatar service owned by Automattic, the company behind WordPress.com. The service links a user's email address to a profile image and publicly visible profile information, which is then displayed automatically across any website or platform that has integrated Gravatar. It was founded in 2004 and acquired by Automattic in 2007. Gravatar profile data is by design intended to be publicly associated with a user's email address across the web.
Why They Hold Your Data
Profile and identity-management services collect emails, usernames, avatar associations, profile metadata, and linked account information used to represent identities across websites.
Recent Developments
Gravatar continues to operate as part of the Automattic ecosystem. No major changes to the service have been publicly announced in the recent period. Its integration is embedded across millions of WordPress installations and third-party platforms globally.
Data Points Exposed
4 verified field types
Email Address
Full Name
Phone Number
Username
Breach Impact
In October 2020 a security researcher demonstrated a method to scrape Gravatar's public API at scale, harvesting profile data — including names, usernames, phone numbers, and email address associations — for tens of millions of users. Gravatar published an FAQ acknowledging the scraping and characterizing the data as public by design, arguing that the service was built to make profile information accessible across the web. The core tension the incident surfaced was whether systematic aggregation of intentionally public data at scale constitutes a privacy harm. No regulatory action or litigation specific to this incident has been documented. The dataset was distributed within hacking communities despite the public nature of the underlying data.
Exploitation & Downstream Threats
• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A data-broker/identity breach: aggregated identity attributes re-seed broker networks and enrich targeting of the individual. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation