Breach Database / Swvl
Yes — Swvl was breached.
- 4.2 million accounts affected
- Breach occurred 2020-06-23 · swvl.com
- Verified entry in the Have I Been Pwned catalog
What happened
In June 2020, the Egyptian bus operator Swvl suffered a data breach which impacted over 4 million members of the service. The exposed data included names, email addresses, phone numbers, profile photos, partial credit card data (type and last 4 digits) and passwords stored as bcrypt hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by breachbase.pw.
What data was exposed
- Email addresses
- Names
- Partial credit card data
- Passwords
- Phone numbers
- Profile photos
What to do right now
- Change your password for this service now. And change it anywhere you reused the same password — attackers try leaked passwords on other sites within hours ("credential stuffing").
- Turn on two-factor authentication. Even a leaked password is useless against an account protected by a second factor. Prefer an authenticator app over SMS.
- Watch your card and bank statements. Set up transaction alerts, and consider a card freeze or replacement if the exposure included full card numbers.
- Be alert for smishing and SIM-swap attempts. Treat unexpected texts and "carrier" calls with suspicion; add a PIN/port-freeze with your mobile carrier.
- Expect convincing phishing emails. Attackers use breached details to write personalized emails. Be suspicious of any message referencing this service.
- Check your other accounts on Have I Been Pwned. Your email address may appear in other breaches you don't know about yet.
- Monitor the apps you use going forward. Clearly watches the breach record for the companies behind your apps and alerts you the moment one appears.
Breach data from Have I Been Pwned. Listing here means the service appears in the public breach record — not that your personal data was affected.