WeLeakInfo data breach: 11K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2021-03-15
In March 2021, the Stripe account of the now-defunct WeLeakInfo service was taken over by "pompompurin" after acquiring an expired domain name with an email address used to manage the account. Access to Stripe then exposed almost 12k unique email addresses from customers who'd made credit card payments in order to obtain breached data hosted by WeLeakInfo. The data was subsequently leaked publicly and also included names, payment histories, IP addresses, billing addresses, partial credit card data and the organisation making the purchase. Exposed data: browser user agent details, email addresses, employers, ip addresses, names, partial credit card data, physical addresses, purchases. The breach dates from Mar 8, 2021; Have I Been Pwned loaded it on Mar 15, 2021.
What to do
- If you had a WeLeakInfo account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
