Breach Disclosure: Hautelook

In February 2019, The Register reported on a trove of information dumps being sold on the dark web. This collection contained details from approximately 16 sources, one of them being Hautelook, a members only shopping website. The Hautelook breach specifically contained 28 million rows of email addresses, names, dates of birth, gender, and bcrypt password hashes. The Hautelook breach, along with 6 previously confirmed by ZeroFOX in the Register report, has been made available to the general public, while other dumps have yet to be disclosed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Hautelook is number 7 out of the 16 breaches from The Register report that have been disclosed to the public. The 1.5 GB data dump was for sale for only $780 on the dark web. When The Register reached out to the company, they did not respond to a request for comment.