Breach Disclosure: Vakinha

The Brazilian fund raising service, Vakinha, suffered a data breach in June 2020, which impacted almost 4.8 million members. According to Bleeping Computer, Vakinha is one of 18 companies whose data was released by a hacker known as "ShinyHunters". Subsequently, the stolen data was shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Vakinha is an online web portal for campaigns that may vary from crowdfunding, birthdays, graduations, weddings, baby showers, and more. A hacker known as Shiny Hunters, posted the stolen data on July 27, 2020 on a popular hacking forum. The breach includes 4.8 million user records.

Figure 1: Vakinha accounts on sale on a hacking forum

The leaked information included in the posting includes email addresses, names, phone numbers, geographic locations, and passwords stored as bcrypt hashes.

Figure 2: Sample Data