If you've ever had an account or relationship with MyHeritage, it's worth checking whether your personal data was exposed in this incident. Here's what happened, what data was involved, and what to do about it.
What Happened
MyHeritage, the genealogy and DNA testing platform, was notified by a security researcher in June 2018 that a file containing user account data had been found on a private server outside the company. The exposed file was traced to a breach that occurred in October 2017, affecting approximately 92 million user accounts.
What Data Was Exposed
The exposed data included email addresses and hashed passwords for accounts created before October 2017. MyHeritage confirmed that DNA test results and raw genetic data are stored on separate, more secure systems and were not part of this breach.
Why This Still Matters
Exposed data doesn't expire. It's sold, traded, and reused for years, fueling credential stuffing attacks — automated attempts to reuse your email and password combination across other sites. If you reused a password anywhere, one old exposure can compromise several current accounts.
How to Check If You Were Affected
Use our free breach checker below — enter your email and we'll scan it against known breach databases instantly, no signup required.
What to Do If You Were Affected
- Change any reused password immediately, starting with your most sensitive accounts.
- Enable two-factor authentication wherever it's offered.
- Monitor financial and health accounts closely if that kind of data was involved.
- Watch for phishing — exposed data is often used to craft convincing scam messages.
- Freeze your credit if your SSN or government ID number was exposed.
👉 Check your own exposure in 30 seconds → scan your email free.
Frequently Asked Questions
When did the MyHeritage data breach happen?
The underlying breach occurred around October 2017, but it was not discovered until June 2018, when a security researcher found the exposed file on an external private server and alerted MyHeritage.
What data was stolen in the MyHeritage breach?
Email addresses and hashed passwords for approximately 92 million accounts created before October 2017 were exposed. DNA test results and genetic data were stored separately and were not affected.
Was my DNA data exposed in the MyHeritage breach?
No. MyHeritage confirmed that DNA data and raw genetic files are stored on isolated, separately secured systems that were not part of this particular incident.
How do I check if my MyHeritage account was affected?
Use the free checker at Scan My Shadow with your email address. If it appears, change your MyHeritage password immediately, especially if it was created before October 2017.
What did MyHeritage do after discovering the breach?
MyHeritage engaged an independent cybersecurity firm to investigate, forced a password reset for all users, and offered two-factor authentication as an added security option going forward.