CashCrate data breach: 6.8M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2018-04-20
In June 2017, news broke that CashCrate had suffered a data breach exposing 6.8 million records. The breach of the cash-for-surveys site dated back to November 2016 and exposed names, physical addresses, email addresses and passwords stored in plain text for older accounts along with weak MD5 hashes for newer ones. Exposed data: email addresses, names, passwords, physical addresses. The breach dates from Nov 17, 2016; Have I Been Pwned loaded it on Apr 20, 2018.
What to do
- If you had a CashCrate account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch