Breach Disclosure: DriveSure

In December 2020, car dealership service provider, DriveSure, suffered a data breach that resulted in the exposure of 3.6 million email addresses of US-based customers. The breach also included names, phone numbers, physical addresses, VIN numbers, odometer readings, and vehicle makes and models.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On January 4, 2021, threat actor "pompompurin" posted a data breach package targeting DriveSure on a cybercriminal marketplace network. The package consisted of a SQL database containing 3,229,101 records of customer information and a 5.93 GB zip archive of files and logs containing the breached data.

Figure 1: A truncated screenshot of the DriveSure leak posted by actor "pompompurin"

The advertisement also contained a full list of the types of data compromised in the breach.

Full Names, Full Addresses, Home Phone, Work Phone, Cell Phone, Email, Hashed Password (bcrypt) 
(Only a small amount of users set a password online - 93,063), Car make & model, VIN Numbers, 
Dealer car was purchased from, Records of how much they paid for service, Warranty Status, 
Emails to customers, Texts sent to customers, IP Addresses, Damage claims, Survey Responses, 
Logs of edits to customers, Current status of car, and much more.

Figure 2: Full list of compromised data types