Breach Disclosure: TrueFire

The popular guitar tutoring website, TrueFire, experienced a data breach back in February 2020, with around 600,000 users data impacted by this breach. According to Bleeping Computer, TrueFire is one of 18 companies whose data was released by a hacker known as "ShinyHunters". Subsequently, the stolen data was shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

TrueFire has experienced a breach prior to the ShinyHunters one, when back in August 2019 through January 2020 TrueFire was victim to a supposed Magecart style breach.

This new breach impacted around 600,000 accounts back in February, and included names, usernames, email addresses, phone numbers, birthdates, account balances, and unsalted MD5 password hashes.

Figure 1 Breach posting for sale on RaidForums