Breach Disclosure: Minted

Minted, the US-based marketplace for independent artists experienced a data breach back in May of this year, exposing the data of 5 million user records. As with numerous breaches lately, ShinyHunters was the group responsible for this breach and posted it to a popular hacking forum for free on October 29th.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Minted had acknowledged this data breach back in May, around the time when this breach happened, which according to Minted's data breach notification occurred on May 6th, 2020. Minted stated that the information disclosed included customer names, email addresses, hashed and salted passwords using bcrypt, telephone numbers, billing addresses, shipping addresses, and in some cases date of birth.

imgur Figure 1: Schema and samples of Minted user data

Earlier this week, ShinyHunters uploaded two other breaches, PromoFarma.com and Star Tribune to add to their ever-growing collection of breaches collected from earlier this year.