FabFitFun data breach: what to do

Malicious code on FabFitFun's sign-up pages captured payment details in 2020, and the Maine Attorney General's filing lists 209,984 people affected. Card payers lost name, address, card number, expiry and security code. PayPal and Apple Pay users lost emails and passwords.

View all 13,177 breaches

Breach date: 26 Apr 2020
Affected: 209,984
Data exposed: Names, Physical addresses, Credit cards, Email addresses, Passwords
Last updated: 27 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

FabFitFun, the subscription box company, told customers in 2020 that malicious code had been inserted into the new member sign-up pages of its website. The code captured what people typed in. The Maine Attorney General's filing gives the breach period as April 26 to May 14, 2020 and May 22 to August 3, 2020, and lists 209,984 people affected in total. Washington's list shows 11,094 residents of that one state, which is part of that total.

What was exposed

Per the company's notice, customers who paid by credit or debit card had their name, address, card number, expiration date and verification code exposed. Customers who paid with PayPal or Apple Pay had their email address and FabFitFun password exposed. FabFitFun said it doesn't collect Social Security numbers, so those weren't part of it.

The company's response

FabFitFun said it removed the malicious code, secured its site and reported the matter to law enforcement. A class action followed, and Bloomberg Law reported a preliminary settlement of $625,000 in February 2021 while the company denied wrongdoing.

What it means for you

A stolen card number can be used for purchases until the issuer replaces it. A password that leaked can be tried on other sites. If you reused your FabFitFun password anywhere, that's the account at risk.

Sources checked: maine.gov, news.bloomberglaw.com, oag.ca.gov

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What to do if you were in it

1

Replace the card you used to sign up

If you paid by card during the breach periods, ask your issuer for a new card number and check statements for charges you don't recognize.
2

Change your password, and any copy of it

Change your FabFitFun password and every other account where you used it. Turn on two-factor login where it's offered. A password manager makes unique passwords easy.
3

Expect messages that mention the breach

Criminals use your name, email address and subscription to make scam emails, texts and calls sound real. Don't click links or call numbers in them. Go to the company's own site, or call the number on your card or statement.
4

Report misuse

If someone opens accounts or files claims in your name, report it at IdentityTheft.gov, the FTC's reporting site, which gives you a recovery plan.
5

Check where else your details are exposed

Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus can't remove breach data, but it alerts you when your details turn up so you know when to repeat these steps.

Official filings

Washington Attorney General , filed 18 Sept 2020 : 11,094 people

Timeline

26 Apr 2020
The breach happened
18 Sept 2020
Reported to the Washington Attorney General

Frequently asked

Was I affected by the FabFitFun breach?

If you signed up as a new member between April 26 and August 3, 2020, your details may have been captured. Look for a notice letter.

What was exposed?

For card payers: name, address, card number, expiry date and verification code. For PayPal and Apple Pay payers: email address and password, per the company's notice.

Is there a settlement?

Bloomberg Law reported a preliminary class action settlement of $625,000 in February 2021. Check the settlement administrator's site for current terms.

Should I change my password?

Yes, if you had a FabFitFun account. Change it everywhere you used it.