Teen quiz app Wishbone compromised, exposing names of users, 2.2M email addresses, and 287K phone numbers after hackers took contents of unprotected database
A popular social networking app that allows users to create and vote on simple two-choice quizzes lost millions of users records …
Context & Ripple Effects
The 2017 Wishbone breach is the origin point of a leak that kept paying out: the app left a database holding its young user base unprotected, and three years later a hacker was selling details of 40M registered Wishbone users, including passwords still hashed with weak MD5. The through-line is that the initial exposure was never contained — the same records simply changed hands.
Wishbone sits in a cluster of consumer-data failures from the same era: the AI.type keyboard app leaked 577GB on 31M users months after this story, and Quora disclosed a 100M-user breach the following year. Quiz-style social apps were repeatedly the weakest link in consumer data hygiene.
First-order effects
- Wishbone's users — names, 2.2M email addresses, 287K phone numbers — are directly exposed, and because the company reported 3.1M monthly active users shortly after launch, the compromised database covers most of its active base.
Second-order effects
- MD5-hashed passwords mean the breach feeds credential-reuse attacks well beyond Wishbone itself, and the eventual sale of 40M user records shows the data became a commodity rather than a one-time incident.
Third-order effects
- If the pattern holds across Wishbone, AI.type, and myPersonality, consumer apps built fast on cloud databases face structural pressure toward secured-by-default storage and breach disclosure norms, since teen-heavy user bases amplify regulatory and parental scrutiny.
The trend: Consumer social and quiz apps are proving to be a recurring source of large unprotected-database breaches whose stolen records circulate and resell for years after the initial exposure.