Fishbrain App Breach Exposes Password Hashes and User Data for Millions of Anglers Cybercriminals have stolen password hashes and corresponding salts from Fishbrain, a popular fishing app with over 20 million users, potentially enabling credential-cracking attacks. The breach, disclosed to the California Attorney General’s Office on August 19, also exposed names, dates of birth, email addresses, phone numbers, usernames, and country information. While Fishbrain did not store passwords in plaintext, the company acknowledged that some compromised hashes could be decoded, depending on password strength and the undisclosed hashing algorithm used. The exact number of affected users remains unclear, as Fishbrain has not provided details on the breach’s scale. After detecting the intrusion, Fishbrain patched the vulnerability, reset all user passwords, and required users to create new credentials upon next login. The company also restricted access to the affected environment, enhanced security controls, and launched a broader review of its data protection measures. With stolen personal data in hand, attackers may leverage the information for phishing or follow-on attacks, posing additional risks to users. The investigation remains ongoing.