Breach Disclosure: ShopBack

In September 2020, ShopBack, a cashback reward program available across the Asia-Pacific, suffered a data breach. The leaked database was posted on several popular hacker forums and contains over 20 million records including email addresses, contact numbers, geolocation, names and salted SHA-1 hashed passwords. The breached data totals almost 1.45gb.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On November 11th, 2020, a threat actor under the aliases of "Polaris” and "LeakedInsta" posted a data breach package targeting the organization ShopBack. The database was advertised within several forums including XSS and RaidForums. Credit was also given to ShinyHunters within these posts, indicating the well known data breach brokers were involved in obtaining or the distribution of this data.

Shortly after the breached data was made available, ShopBack responded to the news, and forced a password change for all users of the platform.

Figure 1: RaidForums post advertising the breached data