KomplettFritid data breach: 139K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2023-01-23
In January 2023, the online Norwegian store KomplettFritid was reported as having had a data breach dating back to February 2021. The incident exposed 140k customer records including physical, email and IP addresses, names, phone numbers and passwords. Most passwords were stored as bcrypt hashes with a small number appearing in plain text. Exposed data: email addresses, ip addresses, names, passwords, phone numbers, physical addresses. The breach dates from Feb 1, 2021; Have I Been Pwned loaded it on Jan 23, 2023.
What to do
- If you had a KomplettFritid account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
