Breach Disclosure: MeetMindful

MeetMindful, the online dating site has reportedly experienced a data breach impacting the PII of over 2.28 million members. This breach has been attributed to Shiny Hunters, who continue their spree of compromising companies and releasing the data on popular hacking fofurms.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Reports have said this breach happened one year ago, with breach data just now surfacing on hacker forums. Included in this breach was PII for over 2.28 million members, including:

Real names
Email addresses
City, state, and ZIP details
Body details
Dating preferences
Marital status
Birth dates
Latitude and longitude
IP addresses
Bcrypt-hashed account passwords
Facebook user IDs
Facebook authentication tokens

This breach is particularly valuable since it provides so much personal information about victims, that can be used for pretexting and in phishing campaigns against these users. In addition, depending on who was on the site, the information can be used for blackmail or for "sextortion" campaigns against these victims as well.

imgur Figure 1: Breach advertisement on RaidForums