Affiliate links on Android Authority may earn us a commission.Learn more.

More than 500,000 Zoom accounts stolen, sold online

July 12, 2025

Zoomcan’t seem to catch a break. After the service experienced a surge in popularity in recent weeks, several of the platform’s numerousprivacy and security flawscame to light, leading toseveral bansand aclass-action lawsuit. In a seemingly unrelated mishap, Zoom now sees hundreds of thousands of its accounts stolen and sold online.

According toBleepingComputer, cybersecurity intelligence firm Cyble spotted the accounts for sale starting April 1. They are currently for sale on the dark web and other hacker forums for less than a penny apiece. Some of the accounts are even being given away for free.

Those affected include several US universities, such as the University of Vermont, University of Colorado, Dartmouth, Lafayette, University of Florida, and more. Other affected well-known companies include Chase and Citibank.

The stolen accounts include the victims’ email addresses, passwords, personal meeting URLs, and their Zoom HostKeys. Cyble purchased approximately 530,000 of these accounts at about $0.002 each and began warning its customers of the breach.

Read also:These developers just hacked the TikTok app with a DNS attack

Interestingly, this doesn’t seem to be Zoom’s fault. Instead, it’s more likely that the attackers gathered these account credentials through stuffing attacks using information stolen in older data breaches.

The only way to protect yourself against these types of attacks is to use unique passwords for each online account you have. This will fend off data breaches from previous attacks affecting your other accounts.

With that said, you should probably change your Zoom account password right now to mitigate the situation. You can also check if your Zoom or other online account credentials have been stolen through websites likeHave I Been Pwnedand Cyble’s very ownAmIBreached.

Thank you for being part of our community. Read ourComment Policybefore posting.