Sonicbids data breach: 751K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2020-08-18
In December 2019, the booking website Sonicbids suffered a data breach which they attributed to "a data privacy event involving our third-party cloud hosting services". The breach contained 752k user records including names and usernames, email addresses and passwords stored as PBKDF2 hashes. The data was provided to HIBP by breachbase.pw. Exposed data: email addresses, names, passwords, usernames. The breach dates from Dec 30, 2019; Have I Been Pwned loaded it on Aug 18, 2020.
What to do
- If you had a Sonicbids account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch