Hub4Tech data breach: 36K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2018-12-09
On an unknown date in approximately 2017, the Indian training and assessment service known as Hub4Tech suffered a data breach via a SQL injection attack. The incident exposed almost 37k unique email addresses and passwords stored as unsalted MD5 hashes. No response was received from Hub4Tech when contacted about the incident. Exposed data: email addresses, passwords. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on Dec 9, 2018.
What to do
- If you had a Hub4Tech account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
