Breach Disclosure: Unico Campania

Neapolitan public transport website Unico Campania reported a breach this week that impacted 166,000 users. This breach contained email addresses and passwords which were then circulated online. The company acknowledged the breach and stated that all passwords were reset and they are currently investigating how this breach occurred.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

According to a user on RaidForums, this data was originally posted by another forum user in January 2020, which would contradict claims by the company that they were breached this week. The user posted sample data on the forum and uploaded it for free on a hosting site.

Figure 1: Forum posting of Unico Campania breach data for free

The method of breach or who the perpetrators are is still unknown at this point.