Breach Disclosure: Lumin PDF

In April 2019, Lumin PDF, a PDF service that is most commonly used with Google Docs, experienced a breach of an exposed MongoDB server. The breach consisted of 24,386,039 users with varying levels of data exposed, which included full names, email addresses, gender, language and locale settings, and a hashed password string or Google access token.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media
Disassociate the Lumin PDF app from your Google account, revoke the token associated with Lumin PDF, and then reconnect (if desired). Instructions can be found in this Google Drive support page.

Details

Roughly 5 months ago, the Lumin PDF MongoDB server was compromised and all records related to Lumin PDF were stolen. These types of attacks on open MongoDB servers (or other database servers) have been increasing in recent years due to companies deploying their servers in the cloud and not taking proper precautions to secure them properly, which leaves them vulnerable to being easily identified and subsequently compromised.

The hacker included a link to the 2.25GB ZIP file, which contained a 4.06GB CSV file containing the records of the 24,386,039 users. The majority of users had a Google access token associated with them, with about 118,746 users had a hashed password string which suggests this password was generated through the Lumin PDF website itself.

After the initial breach in April 2019, the server was compromised again and the data and server itself were destroyed by ransomware. At this time, the details around the second compromise which destroyed the server are not known, but it is not assumed to be related to the first compromise which stole the data.

There have been questions and concerns around the data contained in the breach, with the CEO of Lumin PDF stating that the leaked data did not contain valid Google access tokens. The tokens have not been tested for validity, so it is unknown whether or not these are legitimate and valid tokens. If they were valid, this would allow certain levels of access to Google Drive accounts based on the levels of permissions users granted those access tokens.