Breach Disclosure: The Phone House Spain

The actor behind Babuk ransomware has advertised that they have compromised mobile communications retailer The Phone House Spain. The group claims they have stolen as many as 13 million customer data records, including 5.2 million email addresses.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 16th, the operators of Babuk ransomware posted a claim on their dark web victims page that they had compromised The Phone House Spain. The claim stated that they had stolen an "entire dump of their 10 Oracle databases" with customer details that include full name, date of birth, email address, and phone number, among other sensitive data. The data published so far includes 5.2 million email addresses, 58% of which were already present within the Have I Been Pwned website. Babuk is an actor that operates in "double extortion" tactics, meaning that during a breach they exfiltrate sensitive data from victims to use as extra leverage to entice payment of the ransom in addition to encrypting the victim's systems.

Figure 1. The listing for the Phone House Spain breach on Babuk'92s ransomware victims web page.

Figure 2. An except of the ransom note from the Babuk ransomware.