Breach Disclosure: Promofarma

Breach Disclosure: Promofarma

A Spanish online pharmacy chain, Promofarma, has suffered a data breach, impacting millions of customers. This data breach was put up for sale on popular hacker forums. The leaked data contains approximately 1.3 million unique customer email addresses and names. Promofarma has yet to acknowledge the breach.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Hackers have stolen the customer data belonging to Promofarma and posted it for sale on hacker forums for an undisclosed price. According to an ad placed on a popular hacker forum the leaked data was obtained directly from the Vinny Troia servers that appeared for sale on a dark web marketplace in August last year. The leaked data consists of email addresses and md5 hashed passwords. The leaked data exposed the information of nearly 2.7 million Promofarma customers with almost 1.3 million unique customer email addresses and names.

Figure 1: Promofarma database ad on a popular hacker forum.

The leaked information includes:

• First name
• Last name
• Email addresses
• Passwords (md5 hashed)

Figure 2: Sample data from the Promofarma breach posted in an ad on a hacker forum.