Researchers Tie Uiggy Facebook App Breach to 2.6 Million Records

HEROIC analysts identified the Uiggy data breach while monitoring dark web forums and Telegram channels for recieved credential dumps. The breach occured in June 2016, when the Uiggy Facebook application was compromised, exposing 2,679,607 records. The leaked data included email addresses, first names, last names, genders, and Facebook IDs belonging to users of the social app.

How Attackers Use Names, Emails, and Social Media IDs

When criminals get access to a combination of real names, email addresses, and social media identifiers, the result is partcularly dangerous. They can craft convincing phishing emails addressed to you by name, impersonate contacts on Facebook, or build detailed profiles used to answer security questions on banking and email accounts. This kind of data makes social engineering attacks far more believable.

What Was Exposed in the Uiggy Breach

• Email Address
• First Name
• Last Name
• Gender
• Social Media (Facebook ID)

Why the Uiggy Breach Still Puts You at Risk Today

Many people who used Uiggy in 2016 have never changed the passwords tied to their email accounts from that era. That makes them vulnerable to credential stuffing, where attackers try old username and password pairs across dozens of services. Combined with the real names and Facebook IDs in this dataset, the risk of account takeover and identity theft remains very real. Seperate from the passwords, the social profile data alone enables targeted fraud.

How a Database Breach Works

A database breach happens when an attacker gains unauthorized access to the servers where a company stores user information. This can happen through weak passwords on admin accounts, unpatched software vulnerabilities, or stolen access credentials. Once inside, the attacker copies the database, which can contain millions of user records, and sells or publishes it online. The company may not even know the breach happened for weeks or months.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you whether your email address or personal data appeared in the Uiggy breach or hundreds of other incidents. Run a free check at HEROIC.com to find out what information about you is circulating online and what steps you should take to protect yourself.