Breach Disclosure: Dave
|by Alpha Team
Breach Disclosure: Dave.com
Dave.com, a digital banking app, confirmed a security breach on 25 July 2020. The blog post from the company said that a former third party service provider was compromised which resulted in unauthorized access to data on Dave.com's platform. The company said that names, emails, birth dates, physical addresses, phone numbers and bcrypt hashed passwords were compromised. In total, approximately 7,500,000 accounts were compromised.
Recommendations
- Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
- If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
- If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Details
ZDNet broke the story on 26 July 2020. According to an email with Dave.com, a former business partner, Waydev, which was used by the engineering teams at Dave.com, was compromised and then used to pivot into their databases.
On 24 July 2020, ShinyHunters, a data breach broker that has been in the media numerous times as well as tracked by ZeroFOX Alpha Team, made a post on RaidForums advertising the breach.
The post made by ShinyHunters was one day before the public announcement by the Dave.com team.
Tags: technology, data breach, global