Fishbrain breach exposes password hashes for 20M users

Fishbrain, the fishing-focused social app with more than 20 million users, has confirmed a breach that gave attackers password hashes for an unknown number of accounts. In a notice filed with California's attorney general, the company said an unauthorized party accessed the environment hosting user data as early as July 30, 2026, and that it discovered the intrusion on August 19.

The exposed data includes full names, email addresses, phone numbers, usernames, country, date of birth, and each affected account's password hash and its corresponding salt. Fishbrain said passwords were never stored in plaintext, but it has determined that "the compromised password hashes for some users may be susceptible to being decoded." The company hasn't disclosed which hashing algorithm it used.

That distinction matters for anyone shipping their own auth system. A salted hash alone doesn't guarantee safety, it depends on the algorithm's cost. Fast, general-purpose functions like MD5 are cheap to brute-force once an attacker has both hash and salt: Kaspersky's own 2026 analysis of 231 million leaked passwords found a single RTX 5090 could crack 48% of MD5 hashes in under a minute and 60% within an hour. Slower, memory-hard functions built specifically for password storage, bcrypt, scrypt, or Argon2, are designed to make that same attack expensive even with the salt in hand.

Fishbrain has reset passwords and terminated active sessions for affected accounts, and it's telling users who reused their Fishbrain password elsewhere to change it immediately. For a team picking a password-hashing library today, this is a reminder to check the actual algorithm and cost parameters in use, since hashing alone offers no guarantee.