Breach Disclosure: Drizly

A US-based online alcohol delivery service, Drizly, suffered a data breach in July 2020. According to TechCrunch, the company sent emails to customers and alleged that ‘..a hacker obtained some customer data’. The data was sold online before being extensively redistributed on various dark web markets and forums. The stolen data was initially put up for sale on RaidForums by ShinyHunters.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Drizly is one of the biggest online alcohol delivery services in the U.S. and Canada. It suffered a data breach that exposed approximately 2.5 million Drizly accounts to hackers. Although the company said that no financial data was taken in the breach, a listing on a dark web marketplace from a well-known seller of stolen data claims otherwise.

Figure 1: Fresh Drizly Accounts for sale Source: TechCrunch

ShinyHunters posted the download link, schema and sample data on RaidForums, a popular hacking and cybercrime forum. The schema is as follows:

id
partner_id
email
status
first_name
last_name
legacy_password
password_hash
password_salt
braintree_id
card_status
billing_name_old
billing_address_old
billing_address2_old
billing_city_old
billing_state_old
billing_zip_old
billing_phone_old
delivery_name_old
delivery_address_old
delivery_address2_old
delivery_city_old
delivery_state_old
delivery_zip_old
delivery_phone_old
flag
birth_year
latitude_old
longitude_old
token_old
birth_date_string
birth_date
invite_promo_code_id
invite_reward_promo_code_id
referred_by_user_id
registerDate
logs
redacted_cc_old
device
version
user_agent
register_version
last_sign_in_at
button_access_token
store_group_id
is_covered
tax_exempt
sift_score
ip_address
covered_at
origin_country_id
marketing_optin
delivery_fee_override
substitution_preference
is_corporate
is_covered_by_shipping
is_covered_by_delivery
partner_token_id
phone