Staminus data breach: 26K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2017-10-05
In March 2016, the DDoS protection service Staminus was "massively hacked" resulting in an outage of more than 20 hours and the disclosure of customer credentials (with unsalted MD5 hashes), support tickets, credit card numbers and other sensitive data. 27k unique email addresses were found in the data which was subsequently released to the public. Staminus is no longer in operation. Exposed data: credit cards, email addresses, ip addresses, passwords, support tickets, usernames. The breach dates from Mar 11, 2016; Have I Been Pwned loaded it on Oct 5, 2017.
What to do
- If you had a Staminus account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
