Breach Disclosure: PetFlow

In May of 2020, a file appearing to be from the October 2017 breach of the pet care delivery service PetFlow appeared on the dark web. This breach is related to one of the larger breaches in recent years from Gnosticplayers, which consisted of 16 sites totaling around 620 million users. Various sites were compromised due to unknown flaws, with some researchers speculating the breaches were from an undisclosed SQL vulnerability. 8 new sites were added to that list of compromised sites early last year, containing sites like YouNow, Houzz, Ixigo and Petflow.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

This month, a popular hacking forum posted the PetFlow breach data for all users to view, which was previously being sold on various dark web forums. It is possible someone or a group of individuals purchased this breach and began giving it away to others, however, it is not known at this time how the users responsible acquired the original breached data. Almost 1 million accounts were impacted and the breach exposed email addresses and passwords stored as unsalted MD5 hashes.

Figure 1: Breached data offered for sale on a hacking forum.