Wishbone, a social polling app popular with teenage users, suffered a data breach in January 2020 that exposed the personal information of approximately 9.7 million accounts. The breach was linked to ShinyHunters, a hacking group responsible for several high-profile intrusions during this period. The stolen dataset was published on a hacking forum and widely redistributed. It was the second time Wishbone had been breached, following an earlier incident in 2016. Wishbone made no prominent public statement about the incident. The exposed data included email addresses, names, phone numbers, dates of birth, genders, geographic locations, IP addresses, profile photos, social media profile links, and authentication tokens. Passwords were also included, stored using unsalted MD5 hashing, a weak protection method that makes them relatively easy to crack. The authentication tokens are particularly serious because they can allow attackers to hijack active user sessions without needing a password at all. Given that Wishbone's user base skewed young and female, many of those affected may have been minors at the time. No prominent regulatory action or legal proceedings were publicly reported in connection with this breach. Wishbone has since shut down as an active platform. Affected individuals face ongoing risks including account takeover across other services if passwords were reused, targeted phishing using their personal details, and identity linkage through the combination of social, location, and demographic data exposed.

Social polling and quiz platforms collect user accounts, profile data, quiz responses, social activity, and engagement records tied to mobile social interaction.

Wishbone no longer operates as an active platform. The app was discontinued, though the exact timeline of shutdown has not been prominently documented.