Breach Disclosure: Glofox

Glofox, a gym management software company, had 2.3 million accounts breached in March, 2020. This breach has been attributed to ShinyHunters, which are continously uploading breaches to various hacking forums. While no financial information or credit card details have been exposed, personal information such as names, addresses, phone numbers, passwords and birthdays may have been included in the breach.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On March 27 2020, Glofox had reportedly been breached by ShinyHunters, with the data making rounds in November of 2020 on various forums and marketplaces. A user known as "Hater" posted the data to RaidForums on November 11 2020 and stated that there were 5.2 million users information (as opposed to the 2.3 million stated in numerous news articles).

In addition to the PII referenced above (names, emails, phone numbers), the activity of the users breached was also included in some cases, which included the gym they are a member of, which could possibly be used by threat actors for pretext in phishing attacks.

Figure 1: Screenshot of Glofox breach listing on Raidforums