Breach Disclosure: Morele

Morele.net, one of the first internet shops in Poland, suffered a data breach in October 2018. On April 20, 2019, the data was made available to ZeroFOX Customers via our Credential Compromise capabilities. This breach contains 2.5 million rows of email addresses, names, telephone numbers and passwords hashed as md5crypt. Although the breach occurred back in October 2018, it was publicly disclosed by the Polish security blog Niebezpiecznik on December 18th 2018.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

According to GDPR, a site that stores the Personal Identifiable Information has up to 72 hours to inform the Office of Personal Data Protection and the victims involved, which Morele allegedly did not do. The blog Niebezpiecznik has been chronicling the breach timeline on their website, bringing to attention some of the shortfalls that Morele had with the breach disclosure. One post describes an SMS phishing campaign using data from the breach to attack the victims who were affected. The breach was made public and available to download by RaidForums user ostrich on April 20, 2019.