Breach Disclosure: Cit0day

Around 23,600 databases have been leaked online from a defunct "data breach index" site after the site shut down in September of this year. The database breach data was originally served on the site Cit0day.in, which was a private service often advertised on underground forums. This site operated similar to the now shut-down sites LeakedSource and WeLeakInfo, which contained breached data of usernames and passwords and provided that to users for a small monthly fee. In total, there are around 226,883,414 unique email addresses contained in all the breached data.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This data first appeared on a popular Russian-speaking cybercrime forum, and has since been shared on other popular cybercrime forums for users to freely download. While there are millions of emails and passwords included in this dump, it appears that of the 23,000 leaked databases included, there are many small unknown sites included with most of them being a few years old. In addition, many of the sites in question contained little to no security when it comes to password hashing, with a large portion of credentials being in plaintext.

A well-known security researcher analyzed the dataset and uncovered that around 65% of the email addresses in the breach have been seen before in breached data, which results in a large number that have been compromised previously, but are just now finding out they have been compromised.

There are been collections of breached data like this shared before, with a recent notable example being the "Collection #1" dump, which included usernames and passwords from around 2000 previous data breaches, compromising of about 773 million unique email addresses and 21 million unique passwords. Collections like this can be extremely valuable to attackers for credential stuffing attacks and depending on the type of other information included, could lead to more advanced social engineering attacks.

Figure 1: Posting on Raidforums advertising dump

Figure 2: Posting on Russian hacking forum advertising dump