Breach Disclosure: Fotolog

Around December 2018, a social network for photographers experienced a data breach impacting around 16 million accounts. This data was lumped together with a large breach of 16 various sites, totalling around 617 million accounts being sold on the dark web.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

A variety of sites data, including Fotolog, MyFitnessPal, MyHeritage, Dubsmash, 500px, Armor Games, and many others were being sold on the dark web. Just recently, the Fotolog data has been making its rounds on the dark web being sold and released.

In total, there were five SQL databases containing email addresses, SHA256-hashed passwords, security questions and answers, full names, locations, interests, and other profile information. Given the sensitivity of the type of data included, there is an increased possibility of this data being misused or to further exploit victims of this breach.

Figure 1: Example Dark web market posting of Fotolog breach data being sold