Breach Disclosure: EventBuilder

In June 2021, EventBuilder exposed more than one million files containing registrants' personal information as the result of a misconfiguration of its Microsoft Teams webinar software. The files contained over 100,000 unique records of full names, email addresses with company names, registrant’s position, phone numbers, questionnaire feedback, and summary.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

On June 10, 2021, a security researcher reported a misconfiguration in EventBuilder that exposed more than 1 million CSV and JSON files with personal information of registrants to virtual events via Microsoft Teams. EventBuilder is a software solution for creating virtual events including webinars, training, online learning, and conferences using Microsoft technologies and integrates with Microsoft Teams and Teams Live Events extension. The publicly exposed details included "full names, email addresses, company names and registrant’s position, phone numbers, questionnaire feedback, and registrant summary that revealed information about the event, such as its name, date, tags, and if the registrant participated or not." ZeroFox acquired the data from a sensitive source with direct access. From this package, ZeroFox extracted 107,397 email addresses. No passwords were found in this breach.