Genesis Market data breach: 8.0M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2023-04-05
In April 2023, the stolen identity marketplace Genesis Market was shut down by the FBI and a coalition of law enforcement agencies across the globe in "Operation Cookie Monster". The service traded in "browser fingerprints" which enabled criminals to impersonate victims and access their online services. As many of the impacted accounts did not include email addresses, "8M" is merely an approximation intended to indicate scale. Other personal data compromised by the service included names, addresses and credit card information, although not all individuals had each of these fields exposed. Exposed data: browser user agent details, credit card cvv, credit cards, dates of birth, email addresses, names, passwords, phone numbers, physical addresses, usernames. The breach dates from Apr 5, 2023; Have I Been Pwned loaded it on Apr 5, 2023.
What to do
- If you had a Genesis Market account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
