Breach Disclosure: Straffic

The Israeli marketing firm Straffic experienced a data breach resulting in the exposure of 140GB of data from an exposed Elasticsearch database. The database contained 305 million rows of data, with 49 million unique email addresses, which also included names, addresses, phone numbers and genders of impacted individuals.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Straffic.io markets itself as a private performance marketing network, and was founded in June of 2017. Typically breached Elasticsearch databases like this are exposed publicly and have either no authentication or weak passwords in place. However, in this case, credentials for Straffic's Elasticsearch database were found on a domain by a DevOps engineer. The engineer discovered the credentials through a domain that had been included in spam SMS messages to him for some time, and ultimately found the file containing credentials for the Elasticsearch instance, allowing him to gain access to the database.