Breach Disclosure: Nitro Software

Nitro Software, the company behind the popular software Nitro PDF experienced a data breach in October 2020. The breach includes user and document databases, as well as 1TB of documents. The breached data has been offered for sale on the dark web via a private auction, and contains email addresses, names, company information and bcrypt hashed passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Nitro Software issued a statement on October 21st 2020, stating the company had been affected by a "low impact security incident", claiming no customer data was impacted. However, the data for sale is listed as containing:

Email address
Full name
Title,
Company
bcrypt hashed password

The breach impacted multiple customers of the service including organisations such as Apple, Microsoft, and Google, and was listed with a starting price of $80,000. The user database within the breached data for sale is reported to contain over 70 million user records.

imgur
Figure 1: Sample of the database dump

The breached data is not currently available via popular hacking forums dedicated to sharing data breaches, however activity and discussion around the breach shows users are actively attempting to contain copies of the breached data.

imgur
Figure 2: Users of popular hacking forum asking for copy of the breached data