Breach Disclosure: Houzz

On 4 Feb 2019, Houzz released a security announcement about an unauthorized disclosure of a file that contained sensitive data about its userbase. Houzz is an online platform for connecting homeowners and housing professionals that also helps broker financial transactions between the two. The breached information contained sensitive account information such as hashed passwords, usernames, IP addresses and zip codes. Social security number and, bank account information were not affected.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

There were approximately 49 million records inside the compromised file. The type of information inside the breach includes the information publicly visible on a Houzz profile, internal identifiers, email addresses, user IDs, "one-way encrypted passwords" [sic], IP addresses and geolocation information. Social media profiles where also disclosed as they were most likely used for Single Sign-on workflows into Houzz. The company learned about the incident in late Dec 2018. The one-way encrypted passwords could mean they were cryptographically hashed, which is the recommended way to store passwords for authentication, but without the company disclosing the algorithm they used it is hard to tell.