Breach Disclosure: Appen

In June 2020, Appen, an AI company, suffered a data breach exposing the details of almost 5.9 million users which were subsequently sold online. According to Bleeping Computer, Appen is one of the 38 companies targeted by a hacker group called ShinyHunters. The compromised data included 5.8 million user records.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Appen is an Australia-based AI company that provides data used for the development of machine learning and artificial intelligence products. Since July 21st, a hacker that goes by the name ShinyHunters began leaking the databases for free on RaidForums. Appen was one of the 38 compromised databases that was put up on sale. The stolen data included 5.8 million of rows of usernames, email addresses, bcrypt hashed passwords, names, IP addresses and phone numbers.

Figure 1 Appen accounts on sale on RaidForums