Breach Disclosure: LiveJournal

Blogging platform LiveJournal appears to have suffered a security breach in 2014, according to multiple hackers on various dark web and hacking forums. Recently, hackers have begun redistributing the credentials of LiveJournal on multiple hacking forums. The leaked information contains 26M unique usernames and email addresses alongside plain text passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Rumors about a LiveJournal security breach have been circulating online for almost two years. In October 2018, multiple users reported receiving their unique/old LiveJournal passwords as part of sextortion email spam campaigns. DreamWidth, a fork of LiveJournal with a shared user base, has also been targeted by multiple credential stuffing attacks. The company has confirmed cases where hackers used old LiveJournal username and password combinations to breach DreamWidth accounts.

In May 2020, hackers were spotted redistributing LiveJournal’s user database on the dark web and on hacking forums. The data contained the usernames, emails, and plaintext passwords of 26,372,781 LiveJournal users.

Figure 1: RaidForums posting of the database, for free

Figure 2: Distribution of LiveJournal database for free on a hacking forum