Gravatar profile add-on leaks data on millions of users

Users who have signed up for password breach monitoring through the HaveIBeenPwned service are being alerted to a large-scale data leak by Gravatar, an add-on service for user profiles owned by Automattic, the company behind blogging platform WordPress.

"In October 2020, a security researcher published a technique for scraping large volumes of data from Gravatar, the service for providing globally unique avatars," HaveIBeenPwned warned.

The researcher is Advantio penetration tester Carlo di Dato, who discovered it was possible to get and enumerate user profile data from Gravatar via the JSON data interchange format.

As a result of the vulnerability, "167 million names, usernames and MD5 hashes of email addresses used to reference users' avatars were subsequently scraped and distributed within the hacking community," HaveIBeenPwned said.

Of the MD5 hashes, just under 114 million were cracked and distributed alongside the source hash, thus disclosing the original email address and accompanying data.

The operator of the HaveIBeenPwned password breach recording site, Troy Hunt, saw his data leaked by Gravatar.

My data is in the Gravatar scrap (and it was in the LinkedIn scrape) and I agree. It's not massive in the scheme of things, but it's still frustrating and I want to know about it.

— Troy Hunt (@troyhunt) December 6, 2021

Hunt said that he would not stop using Gravatar despite the leak.