Breach Disclosure: ToonDoo

The email and IP addresses, salted password hashes, location, and gender of over 6 million ToonDoo users have been exposed in a data breach. This breach occurred in August 2019, with the breach database dump appearing for sale online beginning in November 2019. At present, the ToonDoo site is down and no statement appears to have been released.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

ToonDoo, a platform for creating comic strips, experienced a data breach in August 2019. This breach database was then distributed for sale on various hacking forums. The breach included the email and IP addresses, usernames, locations, genders, and salted password hashed of over 6 million site users. At this time, the ToonDoo site is down. No statement appears to have been released by the site.

A breach dump was initially offered for sale on RaidForums in late October 2019, and contained 4.2 million sets of login credentials.

Figure 1. Initial offering on RaidForums.

A few weeks later, on November 8, 2019, a second version of the dump was offered for sale, containing the information of 6,057,000 users.

Figure 2. Second offering, containing 2 million additional sets of credentials.