Breach Disclosure: YoTePresto

Breach Disclosure: YoTePresto

In June 2020, the Mexican-based lending platform, YoTePresto, suffered a data breach that resulted in the compromise of 1.4 million records. Among these records included IP addresses, email addresses, and bcrypt password hashes. YoTePresto claimed that the breach occurred from an unauthorized user accessing a YoTePresto database. The company also stated that no personal data was compromised in the data breach and that the obtained information could not be used to access customer accounts.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

On June 28, 2020, a threat actor using the alias "Megadimarus" posted a thread on a cybercriminal underground forum advertising the sale of the YoTePresto data breach. The post contained snippets of the compromised database structure, as well as examples of the type of data included in the breach.

Figure 1: Actor "Megadimarus" posted a thread advertising the sale of YoTePresto compromised data