i-Dressup data breach: 2.2M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2016-09-26
In June 2016, the teen social site known as i-Dressup was hacked and over 2 million user accounts were exposed. At the time the hack was reported, the i-Dressup operators were not contactable and the underlying SQL injection flaw remained open, allegedly exposing a total of 5.5 million accounts. The breach included email addresses and passwords stored in plain text. Exposed data: email addresses, passwords. The breach dates from Jul 15, 2016; Have I Been Pwned loaded it on Sep 26, 2016.
What to do
- If you had a i-Dressup account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
