Breach Disclosure: JD

In 2013, Chinese e-commerce service, JD, suffered a data breach in which 13 GB of data containing 77 million unique e-mail addresses were exposed. The breach involved the exposure of usernames, phone numbers, and SHA-1 hashed passwords. The leaked data was posted on cybercriminal underground marketplaces in May 2021.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account.

Details

On May 25, 2021, the Raid Forums actor "SSL3" posted a data breach package targeting the organization JD.com (jd[.]com), also known as Jingdong and formerly called 360buy, is a Chinese e-commerce company headquartered in Beijing. The leaked database is also circulating on the XSS forum. JD is China's second largest e-commerce platform. The website was originally breached in 2013, and data from this breach was also distributed in criminal underground forums in Decmber of 2016, as well, including customer names, addresses, phone numbers, ID numbers, and purchase history. ZeroFOX has not been able to confirm whether the released package from 2021 is the same data from the 2016 release.