Breach Disclosure: Swvl

Breach Disclosure : Swvl

An Egypt-based bus operator app, Swvl, suffered a data breach which impacted over 4 million members. According to [PortSwigger] (https://portswigger.net/daily-swig/egyptian-bus-operator-swvl-hit-by-data-breach), the company became aware of unauthorized access to its IT infrastructure on July 3, 2020. All the stolen data is being shared extensively throughout online hacking communities.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Swvl is a bus-booking application based in Egypt, Kenya, and Pakistan. It suffered a data breach that impacted over 4 million members of the service. The company first detected the incident on July 3, 2020 when they detected unauthorized access to its IT infrastructure. A hacker, identified as ShinyHunters, posted the stolen data for sale on popular dark web forum RaidForums. The compromised data is now being extensively redistributed across multiple dark web forums and marketplaces.

Figure 1: Swvl accounts on sale on RaidForums

The leaked information includes:

Names

Email addresses

Phone numbers

Profile photos

Partial credit card data (type and last 4 digits)

Passwords stored as bcrypt hashes