The Scentbird Breach Happened in 2020. The Data Is Still Going Public.

HEROIC analysts identified the Scentbird breach while tracking datasets that have occured in new aggregation repositories long after the original incident. In June 2020, the US-based online fragrance subscription service Scentbird had a database breach exposing 5,814,929 customer records. The exposed data included email addresses, full names, genders, birthdays, and bcrypt password hashes.

How Leaked Birthdays, Genders, and Password Hashes Enable Credential Stuffing

The combination of bcrypt password hashes with birthdates and gender information gives attackers a strong foundation for targeted cracking attempts. Because many users recieved no public notification at the time, a significant portion may still be using the same passwords across other accounts, making them vulnerable to credential stuffing attacks on email, banking, and social media platforms.

What Was Exposed in the Scentbird Breach

• Email Address
• First Name
• Last Name
• Gender
• Birthday
• Password Hash

Why the Scentbird Breach Is Still a Threat in 2025

Data from 2020 does not expire. The Scentbird records have continued circulating across forums and breach aggregation sites, where they are combined with other leaked datasets to build richer profiles. For consumers who seperate their personal and professional accounts with the same password patterns, exposure here can cascade into far more serious account compromises years later.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a company's backend data storage, often by exploiting software vulnerabilities, weak credentials, or misconfigured servers. Once access is gained, entire tables of user records can be extracted silently. The stolen data is then distributed across hacking communities where it is traded, combined with other leaks, and used in automated credential stuffing and phishing campaigns.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including data from the Scentbird breach. Run a free scan now to find out what information about you is already circulating in underground markets.