MyFHA data breach: 972K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2018-08-09
In approximately February 2015, the home financing website MyFHA suffered a data breach which disclosed the personal information of nearly 1 million people. The data included extensive personal information relating to home financing including personal contact info, credit statuses, household incomes, loan amounts and notes on personal circumstances, often referring to legal issues, divorces and health conditions. Multiple parties contacted HIBP with the data after which MyFHA was alerted in mid-July and acknowledged the legitimacy of the breach then took the site offline. Exposed data: credit status information, email addresses, income levels, ip addresses, loan information, names, passwords, personal descriptions, physical addresses. The breach dates from Feb 18, 2015; Have I Been Pwned loaded it on Aug 9, 2018.
What to do
- If you had a MyFHA account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
