Breach Disclosure: Astoria

Astoria Company LLC, a lead generation company experienced a data breach sometime before January 26th, 2021 when security researchers identified the breached data being posted for sale on a darkweb marketplace. This breach is attributed to ShinyHunters, who are prolific breach brokers responsible for a large number of breaches and subsequent sharing of data.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

According to the breach advertisement, this impacted 300 million user database allegedly from Astoria Company, which consisted of:

Name
Emails
IP Addresses
Birthdates
Address
Social Security Numbers

In some instances, the data also included driver information, VIN numbers, auto accidents, medical history, income, property value, insurance information, family information, education, and much more. This type of information was available due to the type of data that Astoria contains, which can be quite substantial, since they are for generating leads of people interested in certain areas.

Figure 1: Breach posting for sale

This data was originally listed for $250,000, which as we've seen before, has been posted for free some time after the original sale has expired or is no longer profitable.

This breach is extremely valuable to those who are able to obtain it, as it contains extremely sensitive data in some cases, and can be used by threat actors in a variety of malicious ways.