Breach Disclosure: Ulmon

Travel app creator Ulmon has experienced a data breach involving a leak of over 1.3 million user records. This breach appears to date back to January 2020. The stolen user account information includes usernames, email addresses, hashed passwords (only strongly bcrypt encrypted/hashed passwords have been stolen) and, in some cases, Twitter names, Facebook account URLs, telephone numbers, and user “about” texts. Ulmon has confirmed the breach and has notified the affected users via email.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On April 27, 2020, Ulmon became aware of a data breach. An unauthorized party stole data associated with certain Ulmon user accounts in January 2020. The service had almost 1.3M records with 777k unique email addresses, names, passwords stored as bcrypt hashes and in some cases, social media profile IDs, telephone numbers and bios exposed to the hackers. The data was subsequently posted for sale to a popular hacking forum.

Figure 1: Breached data offered for sale on a hacking forum.