Elanic data breach: 2.3M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2020-05-04
In January 2020, the Indian fashion marketplace Elanic had 2.8M records with 2.3M unique email addresses posted publicly to a popular hacking forum. Elanic confirmed that they had "verified the data and it was pulled from one of our test servers where this data was exposed publicly" and that the data was "old" (the hacking forum reported it as being from 2016-2018). When asked about disclosure to impacted customers, Elanic advised that they had "decided to not have as such any communication and public disclosure". Exposed data: email addresses, geographic locations, usernames. The breach dates from Jan 1, 2018; Have I Been Pwned loaded it on May 4, 2020.
What to do
- If you had a Elanic account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
