Breach Disclosure: Kiwi Farms

In September 2019, Kiwi Farms experienced a data breach impacting 4,611 users. In a forum post discussing the breach, the owner of the forum identified the data that was included in the breach, which consisted of IP addresses, account details, recent content created by users, conversations, and private board messages. There is no indication of how this breach occurred at this time.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

The owner of the Kiwi Farms site posted about the breach on the forum last week and identified multiple scenarios of how exposed users were that were included in the breach. They explained that all users included in the breach had IP addresses used since at least the beginning of September exposed, as well as account details (email, birthday), recent content that the users have made, and the recent titles and participants of conversations of users.

The site admin also identified another subset of users, which could have had the full conversations from users included in the breached data, as well as messages from moderator and private boards. The owner made some suggestions to users in dealing with this breach, which included things like using a VPN, creating a false identity to use online, and using a password manager. They also explained further steps they would take to reduce the impact of potential future breaches, to include automatically deleting conversations, modifying policies around account deletions and abandoning plans to monetize the forum.