Tumblr data breach (2013): what happened and what to do
2 min read · Updated November 8, 2026
Data from a 2013 Tumblr breach resurfaced in 2016, containing about 65 million email addresses with salted password hashes. Tumblr told users and reset affected passwords. If you had an account in that period, change reused passwords and check whether your email appears in breach records.
What happened
In May 2016 Tumblr announced that it had learned about a set of user email addresses and passwords from a 2013 incident. It said it had no sign the data was being misused at that time and that it had required password resets.
The records later appeared on sale in hacker marketplaces, and breach-tracking services added them so people could check their own addresses.
What was exposed
- ✓Email addresses.
- ✓Passwords stored as salted SHA-1 hashes.
Were you caught up in a major breach?
Old breaches keep circulating for years. Scan your email against known breach records for a one-time $1.99.
Why it still matters
The delay shows that a breach can stay unknown for years. Data from 2013 was still being traded in 2016, and old lists continue to circulate long after the original incident.
Because only email and password hashes were in the data, the main danger is reuse: anyone who cracked a hash could try the same login elsewhere.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Did Tumblr force password resets?+
Yes. The company said it required password resets for accounts it believed were affected.
Is a 2013 breach still relevant?+
Yes, if you kept the same email or password. Old credentials remain useful to attackers.
What should I do first?+
Check whether your email shows up in breach records, then change any password you reused across sites.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.