Breach Disclosure: Anime Planet

On 7 June 2016, Anime Planet forum administrator sothis posted a potential security breach of the website. The post contains details about an exploit that allowed the attacker get access to their databases, and that the passwords were "encrypted". The administrator also said that "Anime Planet stores passwords on all databases, in a way, so that they cannot be decrypted". The 359,000 affected entries contained email and IP addresses, usernames, dates of birth and md5 or bcrypt hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media.

Details

The passwords were not encrypted, although the forum administrator said so. The md5 passwords are cryptographically insecure to modern cryptographic hash standards, they will not be decrypted but can easily be brute forced. The Anime Planet team took the whole website down for a number of hours to remove the implanted malicious code.