Lumin PDF data breach: 15.5M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2019-09-18
In April 2019, the PDF management service Lumin PDF suffered a data breach. The breach wasn't publicly disclosed until September when 15.5M records of user data appeared for download on a popular hacking forum. The data had been left publicly exposed in a MongoDB instance after which Lumin PDF was allegedly been "contacted multiple times, but ignored all the queries". The exposed data included names, email addresses, genders, spoken language and either a bcrypt password hash or Google auth token. Exposed data: auth tokens, email addresses, genders, names, passwords, spoken languages, usernames. The breach dates from Apr 1, 2019; Have I Been Pwned loaded it on Sep 18, 2019.
What to do
- If you had a Lumin PDF account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch