Breach Disclosure: ixigo

In February 2019, techcrunch published an article of a data breach involving the platform ixigo, a travel and hotel booking website. Techcrunch claims that the same hacker who pilfered sensitive data from 16 websites as reported by The Register was responsible for this breach and is selling it on the darkweb. The ixigo breach contained 17 million rows of names, genders, phone numbers, social media profiles and MD5 password hashes. The company subsequently released a security announcement where they announced a full password reset of all accounts and an action to enable 2-Factor authentication on their platform.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

There were 17 million records released in this dump. The actor associated with these database sales, gnosticplayers, is the same actor who allegedly breached 16 sites earlier this year and sold the information on the darkweb. Ixigo wrote on their website that "...we encrypt all passwords with strong hashing algorithms" in their security announcement, but it turns out that the passwords were just md5 hashes. The company issued a massive password reset for all of their accounts, revoked social account tokens and implemented 2-Factor authentication for their users.