Breach Disclosure: Wanelo

In or around December 2019, digital mall Wanelo suffered a data breach. Hacker and dark web seller gnosticplayers is responsible for this breach. Exposed Wanelo records numbered 23 million, and included email addresses and passwords that were either stored as MD5 or bcrypt hashes.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Databreach dumper gnosticplayers is at it again - this time, the hacker has targeted the digital mall Wanelo. The breachi, dubbed "Round 5" is also purported to contain records from Mindjolt, Evite, iCracked, and others. In total, the breach contails the data of 65.5 million users. The Wanelo breach data was offered for sale on the dark web market Dream Market prior to its shutdown in April 2019, for 0.159 bitcoin (at present time, about $1300).