Wattpad data breach (2020): what was exposed and what to do
2 min read · Updated November 8, 2026
In mid-2020 data from the story-sharing site Wattpad was offered on a hacking forum, with roughly 270 million records reported. It included usernames, email addresses, IP addresses, some personal details and hashed passwords. Change reused passwords, enable two-factor authentication and check your email.
What happened
Wattpad confirmed in July 2020 that an unauthorised party had accessed its data through a vulnerability and said it was working with security experts to investigate and respond.
The stolen database was reportedly shared on hacking forums, and it was later added to breach-tracking services so people could check their addresses.
What was exposed
- ✓Usernames, names and email addresses.
- ✓IP addresses and, for some users, location, gender and birth date.
- ✓Passwords stored as bcrypt hashes, which are harder to crack than older formats but not safe if the password is weak.
Were you caught up in a major breach?
Old breaches keep circulating for years. Scan your email against known breach records for a one-time $1.99.
Why it still matters
Strong hashing helps, yet short or common passwords can still be guessed. A reused password turns a story-site breach into a risk for your email and shopping accounts.
Public usernames and email addresses together make it easier to link anonymous writing to a real person, which can matter for privacy.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Are bcrypt-hashed passwords safe?+
They are much harder to crack than older hashes, but a weak or reused password can still be guessed. Change it if you used it elsewhere.
Does this affect people who only read?+
Yes. Any account with an email address on the platform could have been included.
Should I delete my Wattpad account?+
Only if you no longer use it. Otherwise change the password, turn on two-factor authentication if available and keep your profile minimal.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.