Breach Disclosure: Verifications.io
|by Alpha Team
On 7 March 19, security researcher Bob Diachenko published an article describing his discovery of a large database of emails on an insecure and internet-facing MongoDB server. This trove of data contained approximately 800 million email address and metadata information. The database itself did not contain any sensitive information such as passwords or credit cards, but it does contain potentially personally identifiable information such as phone numbers, date of birth, IP address and some location information. Diachenko notified Verifications.io of the insecure server, and they subsequently shutdown the server as well as their website.
Recommendations
- If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
- If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
- Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
- Remain alert to potential spear phishing attacks through email and social media.
Details
Diachenko outlined in his article that Verifications.io was a peculiar website. It marketed itself as an "enterprise email validation service" which is typically associated with a way for spammers and cybercriminals to upload email addresses to the service to verify it they respond to emails. This is particularly useful if a cybercriminal obtains a large email dump and wants to see whether or not the email inboxes don't bounce the verification email. Diachenko reached this conclusion by prodding the exposed dataset for metadata and found large lists of SMTP servers, dirty words that triggered a bounce, spam traps and blacklisted IP addresses. It is important to note that no passwords or sensitive information was in the dataset, but the scale of the dataset makes an attractive trove for cybercriminals to target victims via email.
Tags: communications, data breach, global