PropTiger data breach: 2.2M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2020-03-24
In January 2018, the Indian property website PropTiger suffered a data breach which resulted in a 3.46GB database file being exposed and subsequently shared extensively on a popular hacking forum 2 years later. The exposed data contained both user records and login histories with over 2M unique customer email addresses. Exposed data also included additional personal attributes such as names, dates of birth, genders, IP addresses and passwords stored as MD5 hashes. PropTiger advised they believe the usability of the data is "limited" due to how certain data attributes were generated and stored. The data was provided to HIBP by dehashed.com. Exposed data: dates of birth, device information, email addresses, genders, ip addresses, names, passwords. The breach dates from Jan 30, 2018; Have I Been Pwned loaded it on Mar 24, 2020.
What to do
- If you had a PropTiger account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
