FaceUP data breach: 87K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2019-01-13
In 2013, the Danish social media site FaceUP suffered a data breach. The incident exposed 87k unique email addresses alongside genders, dates of birth, names, phone numbers and passwords stored as unsalted MD5 hashes. When notified of the incident, FaceUP advised they had identified a SQL injection vulnerability at the time and forced password resets on impacted customers. Exposed data: dates of birth, email addresses, genders, names, passwords, phone numbers, usernames. The breach dates from Jan 1, 2013; Have I Been Pwned loaded it on Jan 13, 2019.
What to do
- If you had a FaceUP account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
