Breach Disclosure: EverybodyEdits

In March, EverybodyEdits published a breach disclosure that exposed 871,000 user records by accidentally exporting user information to a CSV file, which was then accessed by attackers. These records contained email addresses, passwords, IP addresses and registration dates. The passwords were fully hashed and encrypted, and no plaintext passwords were leaked.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Notification of this breach was made public on April 3, 2019. EverybodyEdits disclosed that a file containing 871,000 addresses, passwords, email addresses and dates joined had been leaked and accessed by attackers. While the passwords were encrypted, attackers can use the leaked email address to search prior password leaks in an attempt to gain access to an individual’s EverybodyEdits account. Any sites that share the same password with EverybodyEdits should be updated to a unique password per site as soon as possible. In addition to the leak, the attackers also gained access to an internal database, which linked real names to Facebook accounts, along with the IP address used to access the service. A motivated attacker can use this information to discover the real names of Facebook users and potentially geolocate the user by their IP address.