Breach Disclosure: Catho

ShinyHunters continues their spree of uploading compromised data to popular hacking forums. In March 2020, the Brazilian recruitment website, Catho, was compromised alongside 20 other breached sites and had their data listed on various marketplaces. Catho had around 11 million records exposed, with names, usernames, and plain text passwords exposed in the data.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On July 15, 2020 the hacking group ShinyHunters uploaded the Catho breach containing the 11,000,000 records to the popular hacking forum, RaidForums. Unfortunately for users of the Catho service, the passwords were stored in plaintext, and the data uploaded by ShinyHunters contained these plaintext passwords for attackers to subsequently use in future attacks.

Figure 1: Marketplace listing for Catho breach data