Breach Disclosure: StreetEasy

Real estate company StreetEasy appears to have suffered a data breach. This breach data appeared for sale on the dark web in February 2019, and the listing included over a million EasyStreet accounts and SHA-1 hashed passwords. Exposed breach data includes phone numbers, email addresses and encrypted passwords, and credit card information. Although full card numbers were not compromised, the last 4 digits of customer cards, along with billing address, card type, and expiration date were all exposed.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Data from a 2016 EasyStreet backup server has been compromised. The exact date of this breach is unknown, however, breach data appeared for sale on the dark web in February 2019. EasyStreet is a real estate company, that allows users to search for apartments and apply online for them, among other things.

Compromised data includes usernames, email addresses and SHA-1 hashed passwords, phone number, and card payment information. Fortunately, no full card numbers or CVV/CVC codes have been exposed. StreetEasy has released a statemet urging customers to change passwords and monitor credit card activity, but has declined to give any information on what measures the company will be taking in order to prevent this happening again in the future.