Warby Parker warbyparker.com Warby Parker data breach: what happened and what to do
Between 25 September and 30 November 2018, attackers got into Warby Parker customer accounts using passwords stolen elsewhere. HHS lists 197,986 people. Names, addresses, emails, some payment card data and eyewear prescriptions were exposed.
View all 13,177 breaches- Breach date
- 25 Sept 2018
- Made public
- 20 Dec 2018
- Affected
- 197,986
- Data exposed
- Names, Physical addresses, Email addresses, Credit cards, Eyewear prescription information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
According to the U.S. Department of Health and Human Services (HHS), Warby Parker became aware in November 2018 of unusual attempted log-ins on its website. Between 25 September and 30 November 2018, third parties got into customer accounts using usernames and passwords taken from other, unrelated websites. This technique is called credential stuffing: attackers try leaked logins from one site on many others, hoping people reused them.
In September 2020, Warby Parker updated its breach report to 197,986 affected people. In December 2024, HHS fined the company $1,500,000 for HIPAA Security Rule violations, including a failure to run an accurate risk analysis. Warby Parker didn't contest the penalty.
Sources checked: ocrportal.hhs.gov, identitytheft.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
HHS says the information included customer names, mailing addresses, email addresses, certain payment card information and eyewear prescription information.
Why it matters
The cause was password reuse, so the main lesson is for you: a password leaked from one site can unlock another. Addresses and email addresses also feed targeted phishing, and card details can be misused until the card is replaced.
What to do if you were in it
- 1
Use a different password on every account
Change your Warby Parker password and any account that shares it. A password manager creates and stores unique ones, and credential stuffing only works when passwords are reused.
- 2
Turn on two-factor login
Add a second sign-in step wherever it's offered, so a leaked password alone can't open the account.
- 3
Check card statements and ask for a new card if needed
If a card was saved on your account, review your statements and report unfamiliar charges to your card issuer. Ask for a replacement card if you're worried.
- 4
Expect phishing that mentions the breach
Scammers use real details to sound legitimate. The FTC advises you not to click links or call numbers in unexpected messages; contact the organization using a number from its official website instead.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan against breach databases and the dark web and alerts you if your email or phone number shows up. Serus can't remove data from a breach, but it tells you when to change a password or watch for phishing.
Official filings
- U.S. Department of Health and Human Services , filed 20 Dec 2018 : 197,986 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people did the Warby Parker breach affect?
HHS lists 197,986 people, a figure Warby Parker filed in an addendum in September 2020.
What was exposed?
Customer names, mailing addresses, email addresses, certain payment card information and eyewear prescription information, per HHS.
Was Warby Parker fined?
Yes. In December 2024 HHS imposed a $1,500,000 civil money penalty under the HIPAA Security Rule.
Should I change my password?
Yes, and use a different one on each account. The attacks worked because logins from other breached sites were reused.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
