Breach Disclosure: Kreditplus

The Indonesian credit service, Kreditplus, suffered a data breach in July 2020, which impacted almost 896,000 users. According to Bleeping Computer, Kreditplus is one of 18 companies whose data was released by a hacker known as "ShinyHunters". Subsequently, the stolen data was shared extensively throughout online hacking communities.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

Kreditplus experienced a breach with around 896,000 records, which included 769,000 unique email addresses. Included in the breached data for these accounts was email addresses, names, family information, income details, expenses, religion, and employment information. There is a substantial amount of information included in the breach that could be used by attackers to either phish them or be used to gain access to other accounts.

Figure 1: RaidForums posting for Kreditplus breach data