Breach Disclosure: Netlog

In November 2012, Netlog, a social networking platform based in Belgium, suffered a data breach. This incident was recently disclosed by the Office of Attorney General in California via their website posting. Netlog was discontinued in 2015, but the Office recently was made aware of this breach through "proactive data security monitoring". The database contained 49 million email addresses and plain text passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media.

Details

There is not much information inside the communication issued by the Attorney General's Office. The organization's 1 page disclosure contained some information, such as the data that was compromised, but they did not give any information regarding the password security or the details behind the breach. The disclosure did say that no financial information was present, and that if you had a Netlog account that you should reset your passwords.