Breach Disclosure: NetGalley

On December 21, 2020, NetGalley's website was hacked and defaced, along with hackers accessing a database backup containing user's data. NetGalley is a book promotion site, that seeks recommendations from readers on authors and publishers books in the hopes of generating more recommendations and a wider audience.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Initially thought to just be a defacement of the NetGalley website, the NetGalley team soon realized that one of their backups had been accessed, which included the following details about users:

Login name
Password
Name
Email Address
Mailing Address (potentially included)
Birthday (potentially included)
Company Name (potentially included)
Kindle Email Address (potentially included)

NetGalley had stated that there was no financial information stored in the database, and has reset everyone's password as a precautionary measure. It is unknown at this time if the passwords stored were hashed, and NetGalley has not responded to questions concerning this as of yet.

According to the Have I Been Pwned service, this breach requested attribution to the user pompompurin@riseup[.]net, which the username pompompurin is an active data broker on RaidForums, however, this user has not posted about the NetGalley breach on their account. It is unknown currently if this user is responsible for the breach, or if someone is attributing it to their name for other reasons.