A class action filed June 11, 2026 alleges hackers exfiltrated an internal TikTok database containing names, usernames, emails, phone numbers, dates of birth, gender, language preferences, and location data on 2.4 billion users worldwide. If you have ever created a TikTok account, treat that data as public. Below are the exact steps to take today.
What Actually Happened
On June 11, 2026, a hacker group posted sample records from what they claim is an internal TikTok user database on a criminal forum, offering the full set for sale. A California resident filed suit in the US District Court for the Central District of California the same day, alleging TikTok stored the data unencrypted and failed to prevent the intrusion. TikTok has not publicly confirmed the breach at the time of this writing, but security researchers have validated a subset of the leaked records against public TikTok profiles.
The exposed fields matter more than the raw count. Email + phone + date of birth is enough to attempt account takeover on almost any US financial or streaming service. Location data plus username makes stalking and doxxing trivial. This is not a low-severity leak.
Class Actions Do Not Require Sign-Up
You do not need to "join" the Mortazi v. TikTok complaint or any similar class action right now. If a settlement is reached, notice will be sent to affected users automatically. Anyone asking you to pay a fee or submit banking details to "claim your TikTok settlement" is running a scam.
Immediate Steps (Do These Today)
Step 1: Change Your TikTok Password
Open TikTok, tap Profile, then Menu, then Settings and privacy, then Account, then Password. Set a long unique passphrase generated by your password manager. If you reused this password anywhere else — email, banking, other social platforms — change those too, immediately. Credential-stuffing bots are already testing the leaked emails against every major service.
Step 2: Turn On App-Based Two-Factor Authentication
In TikTok, go to Settings and privacy, Security and permissions, 2-step verification. Enable it using an authenticator app (Google Authenticator, Authy, or 1Password), not SMS. SMS-based 2FA is defeated by SIM-swap attacks, which spike after phone numbers leak — exactly what happened here.
Step 3: Review Active Sessions and Connected Apps
Under Security and permissions, tap Manage devices and log out every device you do not recognize. Then tap Third-party app permissions and revoke access for anything you no longer use. Every connected app is a lateral entry point.
Step 4: Change Your Recovery Email and Backup Phone
If your TikTok recovery email or backup phone number appeared in the breach, attackers can use them to reset other accounts. Rotate them to values that were not in the leak.
Within the First Week
Step 5: Freeze Your Credit at All Three Bureaus
Names, dates of birth, and email addresses on their own are not enough to open a credit line — but combined with data brokers already publish (address, relatives, prior addresses), they get very close. A credit freeze is free, takes about 10 minutes, and does not affect your score.
- Equifax: equifax.com/personal/credit-report-services/credit-freeze
- Experian: experian.com/freeze
- TransUnion: transunion.com/credit-freeze
Step 6: Watch for TikTok-Themed Phishing
Breach data lets scammers write phishing emails that quote your real username, email, and date of birth back to you. Expect messages claiming to be TikTok Support asking you to "verify your account" or "claim breach compensation." TikTok will never ask for your password, verification code, or bank details by email. Always open the app directly instead of clicking a link.
Step 7: Screen Your Calls
Phone numbers in the leak are being auctioned to robocall operators and vishing crews. Turn on Silence Unknown Callers (iPhone) or your carrier's spam-blocking service. Do not answer calls from numbers you do not know — real callers leave voicemail.
Check What Else Is Exposed
Enter every email address you have used for TikTok at HaveIBeenPwned.com. If TikTok records have been ingested there, the exposure will show up. Do the same for old email addresses you may have forgotten about.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Longer-Term Protection
Step 8: Request Your TikTok Data Export
Under Settings and privacy, Account, tap Download your data. Request both Account data and Technical information. This gives you a record of exactly what TikTok has stored on you — useful if you file a claim later and useful for auditing what may now be circulating.
Step 9: Consider Deleting the Account
If you no longer use TikTok, deleting the account limits ongoing risk. Deletion takes 30 days to become permanent; during that window, log in stops the process. See our step-by-step TikTok account deletion guide for the full walkthrough, including how to request removal without your password using GDPR/CCPA rights.
Step 10: Cut Down What Aggregators Publish About You
The real danger of any social-platform breach is not the leaked file itself — it's how criminals combine it with people-search results (address, relatives, prior employers) to impersonate you, reset accounts, or physically locate you. Removing your data from broker sites shrinks that attack surface.
How PrivacyOn Helps After the TikTok Breach
PrivacyOn continuously removes your name, address, phone, email, and relatives from 100+ data broker and people-search sites, so leaked TikTok data cannot easily be enriched into a full identity profile. Included dark web monitoring alerts you if your credentials or personal details appear in underground marketplaces — including the forum where the TikTok records were first posted.
Because breaches ripple across households (family members with shared phone numbers, addresses, or emails), PrivacyOn covers up to 5 people per plan, starting at $8.33/month. Start with a free scan to see how many brokers currently expose your data.
Frequently Asked Questions
How many TikTok users were affected by the 2026 breach?
The class action filed June 11, 2026 alleges the leaked database contained records on 2.4 billion users worldwide. That figure is drawn from the seller's own post on a criminal forum and has not been independently confirmed by TikTok, but sample records validated by security researchers appear to be genuine.
What information was exposed in the TikTok breach?
According to the complaint and the seller's own listing: full name, TikTok username, email address, phone number, date of birth, gender, language preferences, and location data. Passwords and video content were not reported as part of this specific dataset, but credential stuffing against the exposed emails is already underway.
Do I need to join the TikTok class action lawsuit?
No. US class actions do not require affected users to sign up when the complaint is filed. If the case is certified and a settlement is reached, notice will be sent automatically to eligible class members. Anyone asking for a fee to "enroll" you in the settlement is a scammer — refuse and report them.
Should I delete my TikTok account?
If you rarely use TikTok, deletion is the cleanest option. If you still use it actively, at minimum change your password, enable app-based 2FA, and rotate any reused credentials. Deletion begins with a mandatory 30-day deactivation window; logging in during that window cancels the deletion.
Is there a better alternative to relying on TikTok's security?
Yes. The strongest defense is minimizing what any one platform can leak in the first place. Use unique passwords via a password manager, use authenticator-app 2FA, keep your phone number off broker sites, and run a continuous removal service like PrivacyOn so criminals cannot pair leaked TikTok fields with data broker records to impersonate you. A free PrivacyOn scan shows how exposed you currently are.
How do I know if my data was in the TikTok leak?
Check the email addresses you have used for TikTok at HaveIBeenPwned.com. TikTok has not sent breach notifications at the time of this writing, so do not wait for one — assume the data on any TikTok account you have ever created is now public and take the protective steps above.