Breach Disclosure: MobiFriends

In January 2019, Spain-based dating application, MobiFriends, suffered a data breach that resulted in the compromise of over 3 million user records. Email addresses, usernames, date of birth, and passwords were included in the list of compromised records. The data does not include records of images or private messages.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 12, 2020, actor "RFBOT" posted a data breach package targeting the MobiFriends dating app on a cybercriminal marketplace forum. From this package, ZeroFOX extracted 3,688,058 records with usernames, email addresses, and passwords. The leaked database is circulating on other marketplace forums.

Figure 1: Actor "RFBOT" posted a data breach package targeting the organization Mobifriends

The database headers obtained from the breach package are presented in Figure 2.

Breach Package Headers

id, username, password, email, own sex, birth date, PERS_ALTA, PERS_BAJA, PERS_CP, PERS_POBL_CODIGO, province code, country, 
idiom, mobile, operator code, PERS_ULTIMA_ACTIVIDAD, PERS_ESTADO, profile photo, PERS_BIENVENIDA, USER_STATUS

Figure 2: Full list of breach package headers