Breach Disclosure: Raychat

In January 2021, the popular Iranian chat application, Raychat, suffered a data breach impacting over 267 million accounts. Raychat was founded in 2017 as a business and social messaging mobile application, partnering with businesses which could use the app for customer service. The data was discovered to be publicly exposed via a NoSQL database instance before being destroyed by a bot attack. After the breach, 150 million records of user data were distributed on cyber crime forums in May 2021.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Review network logs for potential signs of compromise and data egress.
Enforce administrative or application control restrictions to prevent unauthorized installation of software or media

Details

The breached data was obtained from an exposed MongoDB instance, owned by Raychat. This database held information on millions of users including:

Email address
Hashed password
Name
Telegram id
IP address
Geographic location

After the exposed data was discovered, the database was erased by bad actors which left a ransom note, demanding 0.019 bitcoin (approximately $919 at the time) for data to be recovered. It was unclear however if the data had been downloaded by the actor leaving the ransom note in advance of it's deletion.

On May 3, 2021, the RaidForums actor "datahub" posted a 26 GB data breach package of 150 million records, including "email, bcrypt, name, telegram id, IP, UA, referrer" from the Raychat data breach. The author explained they managed to download most of the exposed data before the database was erased.

Figure 1: Thread from author datahub providing data breach package