Breach Disclosure: ShareThis

In February 2019, The Register reported on a trove of information dumps being sold on the dark web. This collection contained details from approximately 16 sources, one of them being ShareThis, a social bookmarking and sharing tool. The ShareThis breach specifically contained 41 million rows of email addresses, usernames, dates of birth and password hashes. The ShareThis breach, along with others in the Register report, has been made available to the general public, while other dumps have yet to be disclosed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

ShareThis is number 5 out of the 16 breaches from The Register report that have been disclosed to the public. This disclosed breach contained 41 million rows of email addresses, usernames, dates of birth and password hashes. In the company's notice of the breach, they reported that they were informed on February 11 2019 and believe the incident occurred in or prior to July 2018. The company deactivated ShareThis accounts associated with this breach and are engaged with incident response and forensic experts to evaluate the full impact of the breach.