Breach Disclosure: Havenly

In June 2020, the interior design website Havenly suffered a data breach which impacted almost 1.4 million members of the service. The exposed data included email addresses, names, phone numbers, geographic locations, and passwords stored as SHA-1 hashes, all of which were subsequently shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Since July 21st, a hacker that goes by the name ShinyHunters began leaking databases compromised by the group for free on a popular hacking forum. Havenly was one of the 38 compromised databases that were put up for sale.

Figure 1: Database Leak Post by ShinyHunters

Havenly has acknowledged the breach with an email to customers, however, failed to mention that customers data was compromised in their notification.