Soundwave data breach: 130K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2017-03-17
In approximately mid 2015, the music tracking app Soundwave suffered a data breach. The breach stemmed from an incident whereby "production data had been used to populate the test database" and was then inadvertently exposed in a MongoDB. The data contained 130k records and included email addresses, dates of birth, genders and MD5 hashes of passwords without a salt. Exposed data: dates of birth, email addresses, genders, geographic locations, names, passwords, social connections. The breach dates from Jul 16, 2015; Have I Been Pwned loaded it on Mar 17, 2017.
What to do
- If you had a Soundwave account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
