Phone House España data breach: 5.2M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2021-04-22
In April 2021, the Spanish retailer Phone House allegedly suffered a ransomware attack that also exposed significant volumes of customer data. Attributed to the Babuk ransomware, a collection of data alleged to be a subset of a larger corpus was posted to a dark web site and contained 5.2M email addresses along with names, nationalities, genders, dates of birth, phone numbers and physical addresses. Phone House has been threatened with further releases if a ransom is not paid. Exposed data: dates of birth, email addresses, genders, names, nationalities, phone numbers, physical addresses. The breach dates from Apr 8, 2021; Have I Been Pwned loaded it on Apr 22, 2021.
What to do
- If you had a Phone House España account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
