MemeChat Users Targeted: 7,429,908 Emails and Usernames Leaked

HEROIC analysts found a breach tied to MemeChat, dated June 2022, that exposed 7,429,908 user records. The exposed data included email addresses and usernames. No passwords were part of this exposure. The only way to know if your account is among those targeted is to scan your email.

Anyone who signed up for MemeChat is a potential target here. With millions of real email and username pairs in circulation, attackers can run large phishing campaigns that look like they come from the app itself, using your actual username to seem believable.

Just an Email and a Username, Still Enough to Target You

• Email Address: the primary target for phishing attempts and for trying password resets elsewhere.
• Username: your handle on the app, useful for crafting a personalized, convincing scam message.

Why Casual App Users Are Still at Risk

Even without a password in this file, a flood of targeted phishing emails sent to millions of real addresses is a serious problem. The goal for an attacker is not to break into MemeChat itself, but to use this list to trick users into handing over something more valuable elsewhere.

How a Social App's User List Ends Up Exposed

A leak like this typically starts when an app's own user records are accessed without permission and copied out in one large file. That file is then packaged and passed around on forums and messaging apps rather than staying inside the original system.

Were You Among the MemeChat Users Caught Up in This?

Take a moment to scan your email and see what it finds. Since no passwords leaked, the main thing to watch for is phishing messages that reference your MemeChat username to seem legitimate. This applies whether you check a personal or work email account.