Breach Disclosure: CityBee

CityBee, the Lithuanian car-sharing service, suffered a data breach in February 2021 exposing the records of over 110,000 customers. The data includes names, email addresses, unsalted SHA-1 password hashes, government IDs, drivers license details and contact information.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

A hacker under the alias of 000 posted within a popular hacking forum offering the CityBee database for free, as well as advertising the sale of a full backup of CityBee data including other company and customer data. The database contains sensitive information of CityBee customers including email addresses and national ID numbers. CityBee have confirmed the authenticity of the list but claim no financial data is involved.

Figure 1: 000 offering the breached database for free

The post advertising the breach was created in February 2021, however it also explains how the data is from 2018. Subsequent posts by the author detail how the breached data was obtained from an exposed Azure blob storage instance. The hacker explains they were able to brute force directory names from the exposed endpoint until they located a directory named "sql". Within this directory they extracted a full backup of multiple CityBee databases which are being offered for sale at $1000 in bitcoin.

Figure 2: Post detailing how the breach happened on RaidForms

Figure 3: Samples of data posted by the hacker to prove authenticity

The hacker offering the data also directly calls out CityBee, claiming they are "lying" and this data has been exposed for a very long time. They also claim to have more databases for sale from other companies, obtained in a similar fashion.