MyRecon OSINT
Mangatoon
On 13 May 2022, Mangatoon was breached. 23,040,238 accounts were exposed, including auth tokens, avatars, email addresses. MyRecon rates it 75/100, severe. That is about 85% of the population of Australia.
Two things in this record matter more than the 23 million total. The first is salted MD5 password hashing, which is a 1990s answer to a 2022 problem: the salt prevents one cracking run solving every shared password, but MD5 is fast enough that ordinary hardware grinds through common passwords regardless. Anything that appears in a wordlist should be considered recovered.
The second is the auth tokens from social logins. Those are not passwords, they are the credentials a site holds so it can act against the account you signed in with. Their value to an attacker depends entirely on what scope was granted and whether the tokens are still valid, which is why "revoke third-party app access" belongs on the response list alongside "change your password". Most people have never opened that settings page and would be surprised by what is on it.
The note that the company did not respond to repeated contact attempts is worth registering too. A breach where the operator is unreachable means no notification, no forced password reset, and no invalidation of those tokens, so the only person who can act is the user. If you had an account here, go into the social account you used to sign in and revoke the connection yourself.
The story behind the breach
In May 2022, the Hong Kong based Manga service Mangatoon suffered a data breach that exposed 23M subscriber records. The breach exposed names, email addresses, genders, social media account identities, auth tokens from social logins and passwords stored as salted MD5 hashes. Mangatoon did not respond to multiple attempts to make contact regarding the breach.
Breach description from Have I Been Pwned, used under a CC BY 4.0 licence.
How did it happen?
The published account does not explain the exact way the data was obtained.
What was the motive?
The published account does not establish the motive. We cannot tell what the attackers intended from the exposed data alone.
Reported demands or attempts to sell data describe what happened, rather than prove every attacker's intention.
What was the outcome?
23,040,238 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.
The reported exposed data includes Auth tokens, Avatars, Email addresses, Genders, Names, Passwords, Social media profiles, Usernames.
What was exposed, and why it matters
- Auth tokensA stolen session token can be used without ever knowing the password, and password changes do not always invalidate it.
- AvatarsAdds detail to a profile that can be assembled from several breaches at once.
- Email addressesThe address becomes a confirmed, active target, expect more phishing, better aimed.
- GendersSmall on its own; useful to anyone assembling a fuller profile.
- NamesTurns an anonymous address into an identified person, which is what makes targeted phishing possible.
- PasswordsAnyone reusing this password elsewhere has those accounts exposed too, credential stuffing is automated and tries them all within days.
- Social media profilesAdds detail to a profile that can be assembled from several breaches at once.
- UsernamesA handle links this account to every other place the same handle is used.
What to do if you were in it
- Change this password anywhere you reused it, starting with your email account, that is the one that can reset all the others.
- Sign out of all sessions in the account's security settings. Changing a password does not always kill an existing session.
- Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this.
Questions people ask about this breach
Was my email address in the Mangatoon breach?
Use the email box on this page. The result applies only to this incident. If the provider does not cover this breach, we say so. A missing match does not prove you were unaffected.
What data was leaked in the Mangatoon breach?
auth tokens, avatars, email addresses, genders, names, passwords, social media profiles, usernames. Each one is explained above, along with what it means for the person it belongs to.
When did it happen, and when did it become public?
The breach is dated 13 May 2022. It was published to Have I Been Pwned on 6 July 2022, a gap of 55 days during which the data was already out.
Is the Mangatoon breach real?
Yes. Have I Been Pwned lists it as verified, meaning the data was checked against the source rather than taken on trust.
How many people were affected?
23,040,238 accounts. That is about 85% of the population of Australia. That is accounts rather than people, one person often has several.
Read next
Also in the archive
Case Files: how the landmark breaches actually happened →
Three kinds of content appear on this page and they are kept apart deliberately. The breach description is quoted from Have I Been Pwned under its licence. The severity score, the field-by-field explanation and the advice are computed from the record itself, every sentence derives from a number or a flag in it, which is what stops the analysis drifting from the evidence. Anything under the "MyRecon's take" byline is editorial: our reading of this breach, presented as opinion rather than as a finding.