Breach Disclosure: Wattpad

Wattpad, a popular website that allows members to publish stories on various topics, was recently involved in a breach of around 270,000,000 records for over $100,000. This breach has been rumored since July 7th of this year, and was rumored to be sold by Shiny Hunters, the group responsible for a number of high-profile, large breaches in recent months.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The records contained in this database consisted of user names, names, hashed passwords (mix of bcrypt and sha256 hashes), email addresses, and geographic location information. In a message from Wattpad, they claim that no financial information, phone numbers, stories or private messages were accessed during the incident that allowed attackers access to the database.

While the database was initially being listed for ten bitcoins (~$100,000), this breach has appeared on RaidForums for free and has been redistributed in multiple threads since the original posting.

Figure 1: Breach listing on RaidForums