Wishbone 2020 Data Breach
Platform · Social polling and quizzes · Mobile social platform · Global
Wishbone Social Polling App Breach (2020): 9.7 Million User Records Including Auth Tokens, Phone Numbers & Location Exposed
Social polling app.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
17/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
9.7MRecords
2020Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
Wishbone, a social polling app popular with teenage users, suffered a data breach in January 2020 that exposed the personal information of approximately 9.7 million accounts. The breach was linked to ShinyHunters, a hacking group responsible for several high-profile intrusions during this period. The stolen dataset was published on a hacking forum and widely redistributed. It was the second time Wishbone had been breached, following an earlier incident in 2016. Wishbone made no prominent public statement about the incident. The exposed data included email addresses, names, phone numbers, dates of birth, genders, geographic locations, IP addresses, profile photos, social media profile links, and authentication tokens. Passwords were also included, stored using unsalted MD5 hashing, a weak protection method that makes them relatively easy to crack. The authentication tokens are particularly serious because they can allow attackers to hijack active user sessions without needing a password at all. Given that Wishbone's user base skewed young and female, many of those affected may have been minors at the time. No prominent regulatory action or legal proceedings were publicly reported in connection with this breach. Wishbone has since shut down as an active platform. Affected individuals face ongoing risks including account takeover across other services if passwords were reused, targeted phishing using their personal details, and identity linkage through the combination of social, location, and demographic data exposed.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
9.7M records analyzed
About Wishbone
Wishbone was a mobile social polling application that allowed users to compare two items by voting on which they preferred — essentially a digital "this or that" format. The app was particularly popular among teenage users and was noted for attracting a young, primarily female demographic. Wishbone experienced two distinct data breaches and has since shut down as an active platform.
Why They Hold Your Data
Social polling and quiz platforms collect user accounts, profile data, quiz responses, social activity, and engagement records tied to mobile social interaction.
Recent Developments
Wishbone no longer operates as an active platform. The app was discontinued, though the exact timeline of shutdown has not been prominently documented.
Data Points Exposed
12 verified field types
Authentication Token High
Date of Birth High
Email Address
Full Name
Gender
Geographic location
IP Address
Password High
Phone Number
Profile Photo
Social Media Profile
Username
Breach Impact
In January 2020 Wishbone suffered a second breach — the fourth time ShinyHunters was linked to a major platform breach in this period — exposing approximately 9.7 million unique email addresses alongside names, phone numbers, geographic locations, dates of birth, genders, IP addresses, hashed passwords, profile photos, social media profile links, and auth tokens. The dataset was far broader than the 2016 exposure and was published on a hacking forum. Wishbone made no prominent public statement about this incident.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure | • Social media account targeting and impersonation
Principal Risk Advisory
What this means for a principal
A social-platform breach: profile and contact-graph data supports impersonation, enrichment and social engineering. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation