Data Breach: Aptoide

Breach Disclosure: Aptoide

Independent Android app store Aptoide experienced a breach last week and had 20 million user accounts exposed in the breach. Breached data included emails, IP addresses, names, and SHA1 password hashes. On April 18th, 2020, Aptoide acknowledged the breach in a blog post with information about the breach and what was contained in the breached data.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Aptoide is one of the largest third-party Android app stores, with a claimed global userbase of 150 million users, and a million apps. The hacker responsible for this breach claimed to have stolen the details for 39 million of those 150 million, and has only released 20 million so far.

Aptoide initially claimed that the only data available in the breach was passwords and login email addresses, however, the PostgreSQL export file obtained by the hacker, consisted of user's real names, device details, and if provided, date of birth.

Based on this breach, Aptoide has stopped all new account registrations and reset user's passwords while they conduct a forensic investigation into how this breach happened and what data was actually compromised.

This breach has already ended up on popular data breach hosting sites like the one below. This specific breach is offered free for all users of the breach dump site.

Figure 1. Forum posting advertising Aptoide data breach