Breach Disclosure: Star Tribune

The prolific hacking group ShinyHunters has compromised the newspaper Star Tribune, the largest newspaper in Minnesota. This breach contained around 1.8 million records contained in it, containing emails, usernames, passwords, birth dates, addresses and phone numbers.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

ShinyHunters continue their breach spree with the latest compromise of Star Tribune adding to their ever growing collection. Star Tribune has acknowledged this supposed breach in their newspaper and addressed customers stating that this did not contain financial information.

While Star Tribune acknowledged this breach, they stated that they are still working to confirm whether a hack took place, “We haven’t been able to verify that it happened, but we’re acting though it has. The information that the hackers alleged to have accessed is simply used by our subscribers to log on to startribune.com and read the news.”

The full schema for the data compromised is detailed below, along with ShinyHunters stating the password algorithm used by Star Tribune is bcrypt.

imgur Figure 1: Posting of Star Tribune listing

The database has been posted for any user to download on popular hacking forums as of October 29th.