Cybercriminals have obtained password hashes and salts belonging to users of the popular fishing app Fishbrain, prompting the company to reset all passwords and notify authorities. The breach, discovered on August 19, exposed names, email addresses, phone numbers, and other personal data from the app's more than 20 million users.
Fishbrain AB, the Swedish company behind the eponymous fishing app, disclosed the breach to the California Attorney General's Office this week. The unknown attackers accessed a trove of user data including names, dates of birth, email addresses, phone numbers, Fishbrain usernames, country information, password hashes, and salts.
"Fishbrain passwords were not stored in plaintext; however, Fishbrain has determined that the compromised password hashes for some users may be susceptible to being decoded," the company said in its disclosure. It urged users to update passwords used elsewhere and to use strong, unique passwords for each account.
With both hashes and salts in hand, attackers can attempt to crack the passwords offline, though success depends on the strength of each password and the hashing algorithm used, which Fishbrain did not disclose.
After discovering the intrusion and conducting an initial forensic investigation, Fishbrain patched the vulnerability, reset every user's password, and restricted access to the affected environment. The company said it strengthened its security controls and initiated a broader review of its data security measures.
Fishbrain did not specify how many of its claimed 20 million-plus users were affected by the breach. The company warned users to watch for phishing attacks that may use the stolen personal data to target them.
Analysis
Why This Matters
- Users of one of the world's most popular fishing apps now face password cracking attempts and potential account takeovers on other services if they reused passwords.
- The breach highlights the risk of centralized data storage in even niche apps, as personal data like phone numbers and birth dates can fuel targeted phishing campaigns.
- Fishbrain's response — universal password reset — is a strong step, but the effectiveness of the crack depends on the hashing algorithm used, which remains undisclosed, leaving users in the dark about their actual risk.
Background
Fishbrain is a social networking app for anglers, allowing users to log catches, share photos, and find fishing spots. Founded in Sweden, it claims more than 20 million users globally. The company had not previously reported a major security incident. Breaches involving password hashes and salts are particularly concerning because they allow offline brute-force attacks, especially if the hashing algorithm is weak (e.g., MD5 or SHA-1 without proper salting).
Key Perspectives
Fishbrain: The company acted quickly after discovery, resetting all passwords and patching the vulnerability. Its disclosure to the California Attorney General and public notification suggest compliance with data breach notification laws. However, it has not disclosed the hashing algorithm, which limits users' ability to assess their risk.
Users: Anglers who reused their Fishbrain password elsewhere are at immediate risk of account takeover. Fishbrain's advice to change passwords on other accounts is critical, but users may not act quickly enough. The stolen personal data also makes them more susceptible to phishing.
Cybersecurity experts: The combination of hashes and salts is a serious concern. Without knowing the algorithm, experts caution that weak passwords could be cracked in hours. The lack of details on the scale of the breach and the attack vector also leaves the community wondering about the root cause and whether other systems are vulnerable.
What to Watch
- Whether Fishbrain discloses the hashing algorithm used, which would allow security researchers to estimate cracking risk and advise users.
- Any reports of phishing emails or SMS targeting Fishbrain users in the coming weeks, as attackers weaponize the stolen data.
- Potential regulatory action from the California Attorney General or European data protection authorities, given the volume of personal data involved.