Eye4Fraud data breach: 16.0M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2023-03-06
In February 2023, data alleged to have been taken from the fraud protection service Eye4Fraud was listed for sale on a popular hacking forum. Spanning tens of millions of rows with 16M unique email addresses, the data was spread across 147 tables totalling 65GB and included both direct users of the service and what appears to be individuals who'd placed orders on other services that implemented Eye4Fraud to protect their sales. The data included names and bcrypt password hashes for users, and names, phone numbers, physical addresses and partial credit card data (card type and last 4 digits) for orders placed using the service. Eye4Fraud did not respond to multiple attempts to report the incident. Exposed data: email addresses, ip addresses, names, partial credit card data, passwords, phone numbers, physical addresses. The breach dates from Jan 25, 2023; Have I Been Pwned loaded it on Mar 6, 2023.
What to do
- If you had a Eye4Fraud account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
