Gravatar — 114 Million Email Addresses Recovered From Avatar URLs (2020)

What happened

In October 2020 a security researcher published a technique for scraping large volumes of data from Gravatar, the service that supplies a single globally recognised avatar across many websites. 167 million names, usernames and MD5 hashes of email addresses were subsequently scraped and distributed. 114 million of those MD5 hashes were cracked and redistributed alongside the source hash, revealing the original email address.

Gravatar's position, published after the addresses became searchable in HIBP, is that it was not hacked — the data was gathered from a public API doing what it was designed to do. That is accurate, and it is the interesting part.

The design decision at the centre of this

Gravatar works by identifying you with the MD5 hash of your email address. When a site shows your avatar, it builds an image URL containing that hash. The hash is therefore published, by design, on every page where your avatar appears — every WordPress comment, every developer forum, every profile.

MD5 is fast and unsalted, and email addresses are low-entropy: they follow predictable patterns and can be generated in bulk. Hashing a candidate list and matching against a published hash is trivially cheap. Around two thirds of the scraped hashes fell.

So there were no passwords here, and nothing to rotate. What leaked is the identifier — and unlike a password, an email address is the thing everything else is keyed on.

Why this is the identity-chain breach

Every other entry on this list gives an attacker data about a person at one site. Gravatar gives them a join key that works across every site the person commented on.

Consider what falls out. A pseudonymous commenter on a technical blog has an avatar. That avatar's URL contains the MD5 of their email. If that hash appears in the cracked set, their email address is now known — and the same hash on a different site, under a different pseudonym, proves the two accounts are the same person.

That is deanonymisation across unrelated platforms, from data the sites published voluntarily and considered harmless. For anyone who maintained separate identities across communities — which is most people with a professional life and a hobby — this is the breach that collapses them together.

What was and was not exposed

To be precise, because this incident attracts exaggeration: the exposed classes are email addresses, names and usernames. No passwords, no addresses, no payment data. The severity comes entirely from the linkage the identifier enables, not from the richness of any single record.

What to do now