Breach Disclosure: WeLeakInfo

The popular credential selling site, WeLeakInfo, which was recently shut down by the FBI in January of 2020, has been hit by a data breach on March 11th, 2021. This resulted in the data of more than 24,000 customers of the illegal site being released on various hacking forums. The data included users of WeLeakInfo that made their purchases using Stripe, the online sales platform, which included full names, IP Addresses, addresses, partial credit card data, transaction dates, Stripe reference numbers, and phone numbers.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Before the FBI seized WeLeakInfo last year, this site was home to stolen information from over 10,000 data breaches, which was around 12 billion indexed user credentials. According to the seller of this data on hacking forums, the FBI may have missed a domain that was associated with payment processing, which allowed the attacker to take over the domain and harvest the data.

Fortunate for users of WeLeakInfo, only users who used the Stripe payment processing were impacted by the breach, whereas anyone who used Bitcoin or Paypal should be not impacted.

Figure 1: Posting of WeLeakInfo data on RaidForums