Flat Earth Sun, Moon and Zodiac App Data Breach (2024)

On October 15, 2024, 33,000 users of the Flat Earth Sun, Moon and Zodiac app developed by Flat Earth Dave learned that their personal data had been exposed in a breach listed on Have I Been Pwned. The incident revealed email addresses, usernames, plain-text passwords, geographic coordinates, and, for a smaller subset of accounts, full names, dates of birth, and genders.

Details Confirmed in the Disclosure

The primary listing on Have I Been Pwned states that the breach occurred in 2024 and exposed data from the mobile application focused on flat-earth cosmology and zodiac tracking. It confirms 33K unique email addresses were compromised along with usernames, latitude and longitude pairs that pinpoint user locations, and passwords stored in plain text. The disclosure indicates that a smaller number of profiles also contained names, dates of birth, and genders. The exact breach vector and whether the data was exfiltrated by an external attacker or simply left exposed remain unstated in the listing.

Passwords stored in plain text represent one of the most immediately actionable risks because they require no cracking effort. Geographic coordinates tied to user accounts add a layer of physical-world exposure that many people do not anticipate from what appears to be a niche interest app.

Why This Matters for You and Your Family

If you or anyone in your household downloaded the Flat Earth Sun, Moon and Zodiac app, your real-world identity is now easier to connect to an interest that some people treat as a punchline or a red flag. The combination of email addresses, plain-text passwords, and precise latitude-longitude data means a casual observer can quickly determine where you live and what accounts you control. For families this can spill over: a parent’s account may share an email domain with children, or the same password may protect a family streaming service or school portal.

Even though the app’s user base is relatively small, the specificity of the exposed location data turns a theoretical breach into a practical one. Someone with the dataset can map every user who opened the app at home, at work, or while traveling. That information does not expire.

Doxxing and Identity-Chain Risks

The latitude and longitude pairs create a direct bridge between online handles and physical addresses. Once an attacker links your email or username to one of those coordinate sets, they can cross-reference it with property records, social-media geotags, or other leaked datasets. This is exactly how doxxing chains begin: one seemingly harmless interest app leaks location and credentials, then those credentials are tested across banking, email, and gaming platforms.

Plain-text passwords accelerate that chain. If you reused any of those passwords, the exposure is not limited to Flat Earth Dave’s app. Children’s gaming accounts that share family emails or passwords become especially vulnerable because gaming platforms often reveal additional personal details once initial access is gained.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to break those connections where possible.
• Rotate the password used on the Flat Earth Sun, Moon and Zodiac app anywhere it is reused, and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your data appears it is caught and addressed in hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests for any newly surfaced personal records on data-broker and doxxing sites that surface after this breach.

The incident is a reminder that even apps built around fringe beliefs can expose enough precise personal data to fuel identity theft or harassment long after the initial leak. Starting your DoxxScan trial gives you continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping that links scattered handles to your real identity, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts that are frequently targeted once credential leaks occur.