Breach Disclosure: Reincubate

The London, England based technology firm, Reincubate, has disclosed a data breach which occurred some time before October 18th 2020 which exposed approximately 616,000 unique records. The data includes names, email addresses, PBKDF2 hashed passwords and for some users billing information such as addresses and metadata on usage of Reincubate apps and products. Reincubate have acknowledged the breach and released a public statement along with contacting affected customers and performing password resets.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The company was contacted by an anonymous individual reporting to have obtained a copy of their backup data from November 2017 and demanding payment in bitcoin. From further investigation into the data the threat actor had obtained it was identified the source of the breach came from a set of leaked AWS credentials which were exposed in a separate data incident at DataDog. Internal processes to revoke these keys failed which resulted in the keys still being usable after exposure. These keys provided access to an AWS S3 bucket which contained backup data from November 2017. Reincubate have confirmed that they have updated their internal processes and responsible disclosure policies to align with their security standards and UK law enforcement is investigating the incident.

On 25 October 2020, an actor on the vetted Russian cybercrime forum Exploit posted the data for free to forum users.

Figure 1: Buffer posts the Reincubate data on Exploit[.]in