Breach Disclosure: 123RF

Breach Disclosure: 123RF

The stock photo site, 123RF, has suffered a data breach containing 8.3 million user records. This data was advertised for sale on a popular hacker forum. The customer records within the breached data contain full name, email address, MD5 hashed passwords, company name, phone number, address, PayPal email if used, and IP address. There is no financial data in the breach.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

A known data broker under the alias of "ExpertData" placed an ad on a popular hacker forum, offering the breached data for sale. Inmagine group, the owner of 123RF, have acknowledged the breach and stated that a server located at their data center was breached and the hackers "proceeded to copy the membership data." Inmagine group have also stated the database is outdated and not the latest version from 2020, however, the data does contain records dated from October 27th 2020 which could indicate the breach is recent.

Figure 1: Original post from ExpertData selling the data

Since selling the database it appears ExpertData has removed their account from the hacker forum along with all their posts. Subsequently, another user known as Gamer29 is now offering the data for sale attributing the breach to ShinyHunters, another well known hacker which has recently been selling databases for multiple companies.

Figure 2: The recent post from Gamer29 reselling the same data

Figure 3: Schema of the SQL dump from the breached database