Breach Disclosure: Descomplica

During March 2021, the Brazilian educational tech company, Descomplica, suffered a data breach. The breached data contained just under 5 million email addresses, and associated names, partial credit card information, purchase history, and password hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 21st 2021, a threat actor under the alias "notpriv" posted a thread to a popular hacker forum containing breached data targeting the organization Descomplica, a provider of an online educational platform designed to prepare students for college entrance exams based in Brazil. Within the post, multiple download URLs were provided allowing other actors to retrieve SQL dump data provided by the threat actor. In a subsequent post, "notpriv" also claimed to have copies of Descomplica's private repositories held on Github.

The entire post contains download links for several SQL dump files for multiple database tables from Descomplica, including:

Account - Users
Marketing - Leads
Payment - CreditCards
Payment - AppleStoreSettlements
Payment - GooglePlaySettlements
public - users
public - social_media

The data includes sensitive information of Descomplica users including email addresses, names, transaction history, social media profiles and payment card information, which can be used to commit further fraud or social engineering attacks against impacted users.

Figure 1: Raidforums post distributing the breached data