MAC addresses leaked: what it means and what to do

Risk level: low. Can you change it: no. Found in 1 breaches in this directory.

What this data is

A hardware identifier assigned to a device's network adapter, such as the Wi-Fi or Ethernet chip in a phone, laptop, router or smart home device.

The risk on its own

Low risk for most people. A MAC address cannot be used to log in to your devices or accounts. It is normally visible only to nearby networks and equipment, and modern phones often use a random one for each Wi-Fi network.

The risk combined with other data

Linked to your name or account, a fixed MAC address can connect your device to records from Wi-Fi hotspots, venue tracking systems and other breaches, building a location trail. A router's wireless MAC address can also be looked up in public Wi-Fi mapping databases to find its approximate location, which may reveal a home address.

How criminals use it

  • A router MAC address from the breach is looked up in a Wi-Fi mapping database to find where the router sits.
  • A fixed device MAC address is matched against shopping centre or venue Wi-Fi logs to show where you have been.
  • An attacker copies your device MAC address to join a network that only admits known devices.

What to do now

  1. Use private Wi-Fi addresses on phones: on iPhone open Settings, Wi-Fi, tap the network and set Private Wi-Fi Address to Rotating; on Android open the network's settings and choose a randomised MAC.
  2. On Windows, open Settings, Network and internet, Wi-Fi and turn on Random hardware addresses.
  3. Do not rely on MAC address filtering to secure your router. Use WPA3 or WPA2 with a strong Wi-Fi password.
  4. If a router MAC address leaked and your home location is a concern, add _nomap to the end of your Wi-Fi network name to opt out of Google's location database, or replace the router.

Frequently asked questions

Can someone hack me with my MAC address?

Not on its own. It identifies a network adapter, and at most lets someone on the same local network pretend to be that device.

Does my phone already hide its MAC address?

Recent iPhone and Android versions use a private address for each Wi-Fi network by default, but it can be switched off for individual networks, so check.

What does adding _nomap to my Wi-Fi name do?

It asks location services that honour the flag, including Google's, to leave your network out of their Wi-Fi location databases.

Breaches that exposed this data

  • StarNet: 2015-02-26, 139K accounts, Customer interactions, Dates of birth, Email addresses, Genders, IP addresses, MAC addresses

Tools that help

Related guides

Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.