MyHeritage — 92 Million Genealogy Accounts, Found by a Researcher Seven Months Later (2017)

What happened

In October 2017 the genealogy website MyHeritage suffered a breach exposing more than 92 million customer records containing email addresses and salted SHA-1 password hashes. The incident was reported seven months later, after a security researcher discovered the file and contacted the company. In 2019 the data appeared for sale on a dark-web marketplace among the GnosticPlayers batches and began circulating more widely.

What was not in it

Start here, because the assumption runs the other way and the correction matters. No DNA data was exposed. No family trees were exposed. No payment details were exposed. The catalogue lists two data classes: email addresses and passwords.

This distinction is not a technicality. A genetic-data breach would be permanent and would implicate blood relatives who never used the service. This was a credential breach at a company that happens to hold genetic data — serious, but a different order of problem. Pages that blur the two frighten readers about a harm that did not occur while under-serving the one that did.

Salted SHA-1, and seven months of silence

The hashes were salted, so mass cracking across the whole set was not possible; but SHA-1 is fast, so weak passwords fell to targeted attempts. The realistic reading is the same as for Zynga: guessable passwords are gone, long random ones held.

The more consequential number is seven months — and the way the company found out. MyHeritage did not detect this. An outside researcher found a file sitting on a private server and got in touch. Absent that, the disclosure interval would have been longer still, or indefinite.

Every user was making security decisions during those seven months on the belief that their credentials were intact. This is the same lesson as Deezer and LinkedIn arriving from a third direction: a breach check tells you what is known, and known lags real by months or years.

The identity-chain implication

Genealogy accounts are unusual in that their value to an attacker lies almost entirely outside the breached data. The email address confirms that a specific person researches their family history — and family-history services hold, and often display, relatives' names, birth years and locations.

Maiden names, birth towns and mothers' names are the standard answers to account-recovery questions across banking and email. A credential for a genealogy account is therefore a potential route to the material that unlocks accounts elsewhere — not because the breach exposed those facts, but because the account reaches them.

What to do now