Preface
WeHeartIt, an image sharing website, suffered a data breach in late 2013. However, the breach was not discovered until it suddenly appeared on the web a few years later. The company stated that the data breach affected over 8 million customers.
What data is at risk?
The WeHeartIt data breach took place in late 2013 and the breached data includes email addresses, usernames and passwords. According to WeHeartIt themselves, although the passwords were encrypted, the encryption algorithm was weak:
the encryption algorithms commonly used to encrypt passwords in 2013 are no longer secure due to advancements in computer hardware.
WeHeartIt
In a blog post the company said that it has made improvements to its security protocols, password security, its database and the whole system in general. At the time the data breach was announced, the company was still hashing their customers’ passwords with a more secure password hashing algorithm – BCrypt.
Email addresses
The WeHeartIt data breach does not hold that many records compared to some of the other data breaches but on the other hand, it holds over 8 million records. With that many people at risk, naturally there are hundreds of email domains used by WeHeartIt customers. Here’s the top 100 email domains used in the breach:
| # | Email Domain | Quantity |
| 1 | hotmail.com | 2,588,267 |
| 2 | gmail.com | 2,324,102 |
| 3 | yahoo.com | 1,064,937 |
| 4 | live.com | 146,636 |
| 5 | aol.com | 136,488 |
| 6 | hotmail.fr | 118,576 |
| 7 | hotmail.co.uk | 108,108 |
| 8 | qq.com | 79,613 |
| 9 | mail.ru | 75,017 |
| 10 | web.de | 74,567 |
| 11 | ymail.com | 66,480 |
| 12 | hotmail.it | 62,257 |
| 13 | hotmail.de | 53,262 |
| 14 | live.nl | 43,240 |
| 15 | gmx.de | 39,798 |
| 16 | icloud.com | 36,766 |
| 17 | aim.com | 33,472 |
| 18 | msn.com | 32,750 |
| 19 | me.com | 32,651 |
| 20 | hotmail.es | 32,005 |
| 21 | googlemail.com | 30,525 |
| 22 | live.fr | 30,118 |
| 23 | rocketmail.com | 29,613 |
| 24 | live.se | 29,113 |
| 25 | live.it | 24,632 |
| 26 | yahoo.de | 23,530 |
| 27 | outlook.com | 23,372 |
| 28 | yahoo.com.br | 21,916 |
| 29 | live.co.uk | 21,192 |
| 30 | comcast.net | 20,587 |
| 31 | windowslive.com | 18,252 |
| 32 | live.no | 17,768 |
| 33 | hotmail.con | 16,779 |
| 34 | libero.it | 16,734 |
| 35 | yandex.ru | 16,515 |
| 36 | wp.pl | 16,196 |
| 37 | yahoo.co.uk | 16,114 |
| 38 | 163.com | 15,317 |
| 39 | live.de | 15,186 |
| 40 | hotmail.ca | 15,115 |
| 41 | abv.bg | 14,790 |
| 42 | live.ca | 14,455 |
| 43 | hotmail.se | 14,280 |
| 44 | seznam.cz | 14,138 |
| 45 | yahoo.fr | 13,854 |
| 46 | i.softbank.jp | 13,034 |
| 47 | hotmail.nl | 13,004 |
| 48 | hotmail.no | 12,899 |
| 49 | yahoo.co.id | 12,790 |
| 50 | live.com.mx | 12,590 |
| 51 | ezweb.ne.jp | 12,054 |
| 52 | freemail.hu | 11,482 |
| 53 | gmail.con | 10,142 |
| 54 | sbcglobal.net | 9,710 |
| 55 | yahoo.it | 9,688 |
| 56 | citromail.hu | 9,660 |
| 57 | live.com.au | 9,123 |
| 58 | t-online.de | 8,970 |
| 59 | orange.fr | 8,324 |
| 60 | inbox.lv | 8,215 |
| 61 | att.net | 7,922 |
| 62 | yahoo.ca | 7,829 |
| 63 | live.dk | 7,777 |
| 64 | walla.com | 7,770 |
| 65 | o2.pl | 7,462 |
| 66 | verizon.net | 7,050 |
| 67 | mail.com | 6,982 |
| 68 | gmx.net | 6,905 |
| 69 | 126.com | 6,745 |
| 70 | gmx.at | 6,713 |
| 71 | yahoo.con | 6,555 |
| 72 | laposte.net | 6,411 |
| 73 | hotmail.co.nz | 6,078 |
| 74 | naver.com | 6,064 |
| 75 | live.cl | 5,505 |
| 76 | hotmail.be | 5,484 |
| 77 | rambler.ru | 5,476 |
| 78 | bk.ru | 5,414 |
| 79 | softbank.ne.jp | 5,309 |
| 80 | live.com.ar | 5,139 |
| 81 | yahoo.com.ph | 4,994 |
| 82 | live.be | 4,950 |
| 83 | hotmail.com.ar | 4,835 |
| 84 | yahoo.es | 4,786 |
| 85 | yahoo.co.jp | 4,715 |
| 86 | interia.pl | 4,604 |
| 87 | cox.net | 4,528 |
| 88 | op.pl | 4,419 |
| 89 | luukku.com | 4,371 |
| 90 | hotmail.ch | 4,272 |
| 91 | yahoo.gr | 4,233 |
| 92 | bluewin.ch | 4,189 |
| 93 | alice.it | 4,098 |
| 94 | hotmail.fi | 4,085 |
| 95 | btinternet.com | 4,063 |
| 96 | yahoo.com.mx | 4,049 |
| 97 | onet.pl | 3,963 |
| 98 | sina.com | 3,944 |
| 99 | yahoo.com.au | 3,883 |
| 100 | gmx.ch | 3,822 |
Looking at the data, we can tell that WeHeartIt had customers from multiple countries – the TLDs alone tell a lot:
| # | Email Domain | Quantity | Country |
| 1 | bluewin.ch | 2,588,267 | Switzerland |
| 2 | hotmail.fr | 118,576 | France |
| 3 | hotmail.co.uk | 108,108 | Great Britain |
| 4 | mail.ru | 75,017 | Russia |
| 5 | web.de | 74,567 | Germany |
| 6 | hotmail.es | 32,005 | Spain |
| 7 | live.se | 29,113 | Sweden |
| 8 | live.it | 24,632 | Italy |
| 9 | yahoo.com.br | 21,916 | Brazil |
| 10 | live.no | 17,768 | Norway |
| 11 | wp.pl | 16,196 | Poland |
| 12 | hotmail.ca | 15,115 | Canada |
| 13 | abv.bg | 14,790 | Bulgaria |
| 14 | seznam.cz | 14,138 | Czech Republic |
| 15 | i.softbank.jp | 13,034 | Japan |
| 16 | hotmail.nl | 13,004 | The Netherlands |
| 17 | yahoo.co.id | 12,790 | India |
| 18 | citromail.hu | 9,660 | Hungary |
| 19 | live.com.au | 9,123 | Australia |
| 20 | inbox.lv | 8,215 | Latvia |
| 21 | live.dk | 7,777 | Denmark |
| 22 | live.com.ar | 5,139 | Argentina |
| 23 | yahoo.com.ph | 4,994 | The Phillipines |
| 24 | live.be | 4,950 | Belgium |
| 25 | hotmail.fi | 4,085 | Finland |
The WeHeartIt data breach contained email addresses beginning with numbers. Here’s the breakdown:
| The Number An Email Address Starts With | Quantity |
| 0 | 3,177 |
| 1 | 30,795 |
| 2 | 13,199 |
| 3 | 12,237 |
| 4 | 11,575 |
| 5 | 9,619 |
| 6 | 6,580 |
| 7 | 7,735 |
| 8 | 7,174 |
| 9 | 7,956 |
Here’s the breakdown of email addresses beginning with letters:
| The Letter An Email Address Starts With | Quantity |
| a | 849,437 |
| b | 395,243 |
| c | 545,333 |
| d | 354,621 |
| e | 336,285 |
| f | 226,617 |
| g | 260,492 |
| h | 257,914 |
| i | 225,872 |
| j | 473,717 |
| k | 432,979 |
| l | 599,189 |
| m | 901,829 |
| n | 333,116 |
| o | 93,303 |
| p | 284,974 |
| q | 17,981 |
| r | 301,848 |
| s | 744,387 |
| t | 323,095 |
| u | 27,246 |
| v | 185,368 |
| w | 90,045 |
| x | 69,911 |
| y | 92,432 |
| z | 70,105 |
As the breached data had also contained usernames, here’s the breakdown of usernames beginning with numbers:
| The Number A Username Starts With | Quantity |
| 0 | 7,636 |
| 1 | 24,458 |
| 2 | 8,688 |
| 3 | 7,183 |
| 4 | 4,344 |
| 5 | 4,387 |
| 6 | 2,641 |
| 7 | 4,190 |
| 8 | 3,294 |
| 9 | 4,442 |
Here’s the breakdown of usernames beginning with letters:
| The Letter A Username Starts With | Quantity |
| a | 799,366 |
| b | 411,781 |
| c | 527,253 |
| d | 354,888 |
| e | 315,451 |
| f | 245,673 |
| g | 238,174 |
| h | 276,455 |
| i | 272,739 |
| j | 437,981 |
| k | 407,330 |
| l | 616,830 |
| m | 859,625 |
| n | 324,536 |
| o | 105,614 |
| p | 282,271 |
| q | 20,637 |
| r | 285,472 |
| s | 745,826 |
| t | 343,690 |
| u | 37,564 |
| v | 174,377 |
| w | 105,421 |
| x | 93,553 |
| y | 104,884 |
| z | 69,486 |
The conclusion
The WeHeartIt data breach, although relatively small, is a reminder that old systems are targets of hackers too – even legacy systems that have been abandoned by developers can come back to haunt them years later.