Breach Disclosure: Elanic

Major Indian fashion reseller Elanic has experienced a data breach involving over 2 million user records. This breach appears to date back to January 2020. These records contain email addresses of site users. Although Elanic has confirmed the breach, they have stated that they will not disclose the breach either publicly or privately to the affected users. It is unclear as to whether the company will take any remedial action.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Both Elanic and the data dump seller allege that the data is old, and was exposed via an insecure test server. The data dump was offered for sale on a public hacking forum. In total, 2.8 million email addresses, with being 2.3 unique addresses, were included in this dump.

Figure 1. Breach data dump offered for sale on a hacking forum