Breach Disclosure: James Delivery

Breach Disclosure: James Delivery

A Brazilian delivery service, "James Delivery", has suffered a data breach, impacting over a million customers. This data breach was put up for sale on a popular hacker forum. The leaked data contains approximately 1.5 million unique customer email addresses and BCRYPT hashed passwords.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The hacker under the alias of ShinyHunters has stolen the customer data belonging to James Delivery and posted it for sale on a popular hacker forum. According to the ad placed on the hacker forum, there are over 1.6 million rows of data including customer email address, backup email address, device information and the BCRYPT hash of their password.

Figure 1: JamesDelivery database ad on a popular hacker forum.

Figure 2: Sample data from the JamesDelivery breach posted in an ad on a hacker forum.

The threat actor which authored the thread known as "ShinyHunters" has recently been involved in multiple other data breaches and subsequent selling of customer data and has gathered a reputable status within the marketplace.

Figure 3: Profile of the threat actor known as ShinyHunters

Figure 4: Some recent threads by ShinyHunters