Breach Disclosure: Moneycontrol

Breach Disclosure: Moneycontrol

In April 2021, a threat actor posted a data breach package on a cybercriminal marketplace forum targeting the Indian business news website, Moneycontrol. The breach occurred in 2020 and contains over 700,000 records including email addresses, phone numbers, physical addresses, and cleartext passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On April 26, 2021, actor "kehanet00" posted a data breach package targeting the organization Moneycontrol, an Indian online business news website owned by E-EIGHTEEN Dot Com Ltd., a subsidiary of the media house TV18. The leaked database is circulating on other marketplace forums. From this package, ZeroFOX extracted 770,449 records with email addresses and cleartext passwords.

Figure 1: Actor "kehanet00" posted a CSV containing compromised records for Moneycontrol on a cybercriminal marketplace forum

The following contains the full list of database headers obtained from the CSV posted by actor "kehanet00."

Breach Package Headers

User_email,user_pwd,user_country,user_phone,user_mobile,user_pincode,user_dob,user_gender,user_address,user_city,user_state

Figure 2: Full list of database headers within the breached data