Breach Disclosure: Liker

In March 2021, the social network site Liker suffered a data breach. The breach was allegedly in retaliation for the Gab data breach and data scraped from Parler. The site was taken offline following the breach which exposed 465,000 user email addresses, names, dates of birth, private messages, security questions and passwords stored as bcrypt hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

According to posts on the popular hacker forum Raidforums, the breach was facilitated by the user under the alias of badhou3a who used their access to create posts as the social networks support accounts as well as exfiltrate the sites user database. The breach reportedly took place between the 4th and 9th of March 2021 with the information containing:

Email address
Authorization tokens
Dates of birth
Education history
Geographic location
IP addresses
Full names
Passwords (bcrypt hashes)
Phone numbers
Security questions and answers
Social media profiles
Username
Private messages

Figure 1: Raidforums post detailing breach details

Figure 2: Sample of breached data

Liker has yet to make a comment on the breach, and since the data was released on popular hacker forums, the site has been taken offline and remains inaccessible to its users. Liker's website presents a notice informing the site is down for maintenance and upgrades.

Figure 3: liker.com notice