Freecycle disclosed a breach affecting more than 7 million members

Freecycle, the nonprofit network whose members give away unwanted household goods rather than send them to landfill, confirmed at the end of August 2023 that member data had been stolen. Reporting put the number of affected accounts at more than 7 million, out of a membership of roughly 11 million spread across more than 5,000 towns.

The organization said the stolen records held usernames, user IDs, email addresses and passwords, and that no other personal information was involved. BleepingComputer reported that the passwords were stored as MD5 hashes. SecurityWeek reported only that they were hashed. Freecycle said it discovered the breach on August 30, 2023, although the data had been listed for sale on a hacking forum since May 30.

Executive director Deron Beal told members to change their Freecycle passwords immediately and to change any matching passwords used on other services. Cyber Security Hub reported that the database offered for sale allegedly included Beal's own data. BleepingComputer, citing screenshots shared by the attacker, reported that his credentials gave full access to member information and forum posts.

Freecycle warned that members might see an increase in spam and phishing attempts, and said it had reported the incident to authorities in both the United States and the United Kingdom. It did not disclose how the attacker first obtained access.