Breach Disclosure: Zoosk

The online dating site, Zoosk, was involved in a breach dating back to January of 2020, which was identified later in May of 2020. This breach was carried out by the group named "ShinyHunters", who have been compromising and uploading breached companies data to popular hacking forums for free as of late. Around 24,000,000 accounts were included in this breach.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

The data in the breach contained gender, sexuality, date of birth, height, weight, religion, ethnicity, and political views. Some of the data involved in this breach could be damaging to users of the platform in terms of blackmail, as well as attempts to blackmail the individuals included in the breach.

Figure 1: Zoosk breach data listed by a RaidForums member

While ShinyHunters are the purported hackers responsible for the breach, and the ones who typically upload the breaches to RaidForums among other forums, this one was uploaded by the user "Gameranx" with contents identical to other ShinyHunters posts on RaidForums. In the comments section of this breach, ShinyHunters acknowledge the post and reference how Gameranx was faster than them in posting this to RaidForums.

It is our assessment that ShinyHunters posted this to another hacking forum, where Gameranx then downloaded the contents and uploaded it to RaidForums before ShinyHunters could post there.