Social Blade, the analytics service that tracks follower and subscriber counts across YouTube, Twitch, Instagram, and other platforms, confirmed in December 2022 that an attacker exploited a vulnerability on its website and exported its user database. A seller listed 5.6 million records on a hacking forum. The company said credit card data was not involved and that passwords were hashed with bcrypt, so it did not force a password reset. That decision is the reason this breach still matters in 2026: a password set before December 2022 may still be in use, and the incident is not listed in the breach-lookup service most people check.
Table of Contents
- What Social Blade confirmed
- What was exposed
- What bcrypt did and did not protect
- The auth tokens were the sharper risk
- Why a breach lookup will not flag this
- This was the second Social Blade breach
- What to do if you had an account
- Frequently asked questions
What Social Blade confirmed
The database went up for sale on Monday, December 12, 2022, on the Breached hacking forum. The seller, posting under the handle sudocremed, offered it through the forum’s escrow service to only one or two buyers and published a sample of table names and contents to prove the listing was genuine, according to Security Affairs. The listing described 5.6 million records dated September 2022, meaning the data had been sitting in the attacker’s hands for roughly three months before it surfaced.
Social Blade said it learned of the sale two days later. In the notification it emailed to account holders, the company wrote: “On December 14th we were notified of a potential data breach whereby an individual had acquired exports of our user database and were attempting to sell it on a hacker forum. Samples were posted and we verified that they were indeed real. It appears this individual made use of a vulnerability on our website to gain access to our database.”
Two details in that sentence are worth separating. The company verified the samples, so this is a confirmed breach rather than an unproven claim. And the entry point was a website vulnerability, not stolen employee credentials or a compromised vendor. Social Blade said it had closed the flaw and was reviewing its other systems.
What was exposed
Social Blade listed the affected data categories in its notification, and press coverage from SecurityWeek and Infosecurity Magazine matched them:
- Email addresses
- IP addresses
- Password hashes, generated with bcrypt
- Client IDs and tokens belonging to business API customers
- Authentication tokens for social accounts users had connected to Social Blade
- Street addresses, for what the company described as about one tenth of one percent of the data
- Assorted internal and non-personal fields
Social Blade stated that no credit card information was included and that it has never stored passwords in plain text. Both claims narrow the damage in a meaningful way. Neither one addresses the tokens, which is where the more interesting exposure sits.
What bcrypt did and did not protect
A password hash is a scrambled representation of a password, stored so the site can check a login without keeping the password itself. Bcrypt is a hashing algorithm designed to be deliberately slow, which makes guessing enormous numbers of candidate passwords expensive rather than instantaneous. Social Blade leaned on exactly that property. It told users it was “confident that they are not easy to crack,” declined to force a reset across the user base, and recommended a voluntary password change as a precaution.
Slow is not the same as impossible. Bcrypt raises the cost per guess; it does not change the fact that a short, common, or reused password falls quickly even under that penalty. And an offline database is not on a clock. The buyer who acquired these records in 2022 has had years of uninterrupted computing time to work through the weakest hashes, with no rate limit and no lockout to slow them down. The protection bcrypt offers is real and it is proportional to how strong the underlying password was.
The absence of a forced reset compounds this. When a company resets every password, the hashes in the stolen file become worthless the moment users log back in. Social Blade left that choice to the individual, which means any account whose owner ignored or never saw the 2022 email is still protected by the same password that was in the exported database. If that password was reused anywhere else, the exposure extends to every one of those accounts through credential stuffing, where automated tools replay one leaked pair against hundreds of unrelated sites.
The auth tokens were the sharper risk
Password hashes have to be cracked before they are useful. Authentication tokens do not. A token is a bearer credential: whoever holds the string can present it and be treated as the account it belongs to, with no password and typically no second factor in the way. They sat in this database unhashed, because a service that needs to use a token cannot store it scrambled.
That matters here because of what Social Blade users connect. People link YouTube channels, Twitch accounts, and other platform profiles so the service can pull their statistics. A token for a connected account is a path into that platform, not just into Social Blade. Business API customers had client IDs and tokens in the file as well.
Social Blade said it acted on this directly. It notified business API users separately that their tokens had been changed, and said connected-account tokens were cycled where appropriate. Rotating a token invalidates the copy in the stolen file, which is the correct remedy and a stronger one than what the passwords received. Users who connected an account before December 2022 and want certainty can revoke Social Blade’s access from the platform’s own security settings and reconnect, rather than relying on the company’s rotation having covered their specific case.
Why a breach lookup will not flag this
Most people check whether they were caught in a breach by entering their email address into Have I Been Pwned, the free index that powers a large share of breach-notification features across the industry. Social Blade is not in it. A check of the service’s full breach list confirms 1,034 indexed incidents with no Social Blade entry, and a direct lookup for the company returns nothing.
This is a gap in coverage rather than evidence that nothing happened. Breach indexes depend on someone obtaining and submitting the leaked data, and a database sold privately to one or two escrow buyers is far less likely to circulate widely enough to be collected than one dumped publicly for free. The practical consequence for a Social Blade user is direct: entering your email into a lookup tool returns a clean result for this incident even though the company confirmed in writing that your record was exported. Treat a negative result as the absence of a listing, not as proof of safety, and check the breach directory and the company’s own disclosures alongside it.
This was the second Social Blade breach
The 2022 incident was not the company’s first. In 2016, details of nearly 300,000 Social Blade website and forum users were leaked. SecurityWeek reported that the password hashes in that earlier breach were easy to crack, and that Social Blade reset every user password in response.
The contrast between the two responses is the clearest way to read the company’s 2022 decision. In 2016, weak hashing forced a universal reset. By 2022 the company had moved to bcrypt, and it treated that upgrade as sufficient reason to skip the reset entirely. The hashing genuinely was stronger. The reset was also the step that would have retired the stolen credentials outright, and it was the step that did not happen.
What to do if you had an account
Anyone who registered with Social Blade before September 2022 should assume their record was in the export, whether or not they remember receiving the email. Many users in public discussions did not recall signing up at all, having created an account years earlier to look up a channel’s numbers.
- Change the Social Blade password if it has not been changed since December 2022, and change it anywhere else the same password was used. Reuse is what turns one exposed record into many compromised accounts.
- Revoke and reconnect any social platform you linked to Social Blade, using that platform’s own connected-apps or security settings rather than Social Blade’s.
- Turn on two-factor authentication on the email address tied to the account. The exported data included email addresses, and email is the reset path for everything else.
- Rotate business API client IDs and tokens if you held them, even though the company reported cycling them.
- Expect phishing that references Social Blade. The attacker holds verified email addresses and knows which service they came from. Social Blade stated that no one from the company will ever ask for a password or credit card number by email. The FTC publishes guidance on recognizing phishing.
- Check whether the password has appeared in any indexed breach using the password exposure check, which compares a password against known exposures without transmitting it.
If there are signs an account has already been accessed rather than merely exposed, work through the hacked response checklist, which covers securing accounts in the right order.
Frequently asked questions
Was the Social Blade breach real or just a claim?
It was confirmed by the company. Social Blade said it reviewed the samples the seller posted and verified that they were genuine, then emailed affected users in December 2022.
Were credit card numbers stolen?
No. Social Blade stated that no credit card information was included in the exported data. Email addresses, IP addresses, bcrypt password hashes, and authentication tokens were.
Do I still need to change my Social Blade password in 2026?
Yes, if you have not changed it since December 2022. Social Blade never forced a reset, so a password from before the breach is still the password that was in the stolen database.
Why does Have I Been Pwned show nothing for Social Blade?
The incident is not indexed there. The database was sold privately through forum escrow to one or two buyers rather than dumped publicly, so it never circulated widely enough to be collected. A clean result means no listing, not no exposure.
How many people were affected?
The seller advertised 5.6 million records dated September 2022. Social Blade confirmed the breach and the data categories but did not publish its own count of affected users.
You Might Also Like
- How Credential-Stuffing Bots Test Stolen Passwords Against Website Accounts
- Hacked Response Checklist: Passwords, Accounts, and Credit
- Small Business Cybersecurity Checklist After Latest Credential Attacks