Breach Disclosure: Home Chef

Breach Disclosure: Home Chef

The US-based delivery service Home Chef suffered suffered a data breach impacting 8 million customers in February 2020. This data breach was put up for sale on a popular dark web marketplace for selling breached data. The leaked data contains user's email, encrypted password, last four digits of their credit card, gender, age, subscription information, and in some cases, delivery address information.

Recommendations

• Enable 2-factor authentication for all of your organisational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Around May 2020 the hacker under the alias of ShinyHunters listed the Home Chef user database for sale on a popular dark web marketplace for $2500 in Bitcoin (valued at the time). The data was listed along with multiple other companies, such as Zoosk, Tokopedia, Minted, and Chatbooks.

While the original posting for sale has long expired, since the original marketplace has shut down, ShinyHunters posted the data breach for anyone to download on a popular hacking forum. This is standard process for this group, since at a certain point users stop buying the breach and it doesn't become as valuable to market, so they release it for free for others to use.

In total, there were 8,717,763 user records contained in the breach, which contains the following fields below:

Figure 1: Home Chef breach posting

Figure 2: Original marketplace listing for Home Chef database