Breach Disclosure: MangaDex

In March 2021, MangaDex, a website that hosts advertisement-free manga comics, disclosed a data breach that resulted in the compromise of nearly 3 million records. Threat actors posted the leaked database on cybercriminal marketplaces in early April 2021. The data set included users' email addresses, usernames, and bcrypt password hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 6, 2021, an actor using the alias "YuriSeb0" posted a data breach package targeting MangaDex on a cybercriminal marketplace forum. ZeroFOX researchers extracted nearly 3 million records with usernames, email addresses, and passwords.

Figure 1: Actor "YuriSeb0" posted a link to download the MangaDex data breach package

The breach occurred when threat actors gained unauthorized access to a MangaDex administrator account through "the reuse of a session token found in an old database leak through faulty configuration of session management." Shortly after discovering the incident, MangaDex took the website offline to patch vulnerable code and update the website. MangaDex strongly advises website users to change passwords.