Breach Disclosure: Whitepages

In February 2019, The Register reported on a trove of information dumps being sold on the dark web. This collection contained details from approximately 16 sources, one of them being Whitepages, an online directory application. The disclosed information contained 11 million rows of email addresses, names and either bcrypt or MD5 password hashes. The Whitepages breach, along with others in the Register report, has been made available to the general public while other dumps have yet to be disclosed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

Whitepages is number 9 out of the 16 breaches from The Register report that was released to the public in February. This disclosed breach contained 11 million rows of email addresses, names and md5 or bcrypt password hashes. The total size of the breach is 2.9GB and the asking price is $1560. The Register attempted to reach out to Whitepages, and the company did not respond to the request for comment.