Wishbone, a mobile polling app popular among teenagers, suffered a data breach in 2016 stemming from a misconfiguration. The exposed dataset contained 9.4 million records in total, with 2.2 million unique email addresses identified. The breach is believed to represent only a subset of the full compromised data. The exposed information included names, usernames, email addresses, phone numbers, dates of birth, genders, and authentication tokens. Authentication tokens are credentials that keep users logged in to apps and services, and their exposure can allow attackers to access accounts without needing a password. Because Wishbone's user base skewed young and female, the presence of birth dates and phone numbers for potentially underage users raised particular concern. This combination of data enables account takeover, identity profiling, and targeted contact of minors. No specific legal actions or regulatory responses related to this breach are on record. Affected users, especially those who were minors at the time, face ongoing risks including unauthorized account access, social engineering, and the use of their personal details to build profiles for further exploitation. Those who used the same credentials elsewhere are advised to change their passwords on any linked accounts.

Social polling and quiz platforms collect user accounts, profile data, quiz responses, social activity, and engagement records tied to mobile social interaction.

Wishbone no longer operates as an active platform. The app was discontinued, though the exact timeline of shutdown has not been prominently documented.