Breach Disclosure: Lazada RedMart

Singapore's largest online grocery store Lazada RedMart has suffered a data breach, impacting over a million customers. This data breach was put up for sale on a popular hacker forum. The leaked data contains approximately 1.1 million unique customer email addresses, SHA-1 hashed passwords, first and last name, phone numbers, mailing addresses, billing addresses, partial credit card numbers, and expiration dates.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Hackers have obtained customer data belonging to Lazada RedMart and posted it for sale on a popular hacker forum via a data broker under the alias of ExpertData. The price is undisclosed within the post however it has been reported the brokers are asking for $1500 for the full database. The data appears to originate from a Mongo DB which was accessible to the internet. Lazada are aware of the breach and notified their customers via email.

imgur
Figure 1: RedMart database advertised for sale on a popular hacker forum

The leaked data includes:

Email addresses
SHA-1 hashed passwords
First and last name
Phone numbers
Address
Partial credit card numbers, and expiration dates

Lazada have also reported the data is 18 months old and have reset all customer passwords as a precaution, however, some data within the breached database is timestamped from May and July 2020.

imgur
Figure 2: Excerpt from the sample data posted by ExpertData