Fashion Nexus data breach: 1.3M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2018-07-31
In July 2018, UK-based ecommerce company Fashion Nexus suffered a data breach which exposed 1.4 million records. Multiple websites developed by sister company White Room Solutions were impacted in the breach amongst which were sites including Jaded London and AX Paris. The various sites exposed in the incident included a range of different data types including names, phone numbers, addresses and passwords stored as a mix of salted MD5 and SHA-1 as well as unsalted MD5 passwords. When asked by reporter Graham Cluley if a public statement on the incident was available, a one-word response of "No" was received. Exposed data: browser user agent details, dates of birth, email addresses, genders, ip addresses, names, passwords, phone numbers, physical addresses, purchases. The breach dates from Jul 9, 2018; Have I Been Pwned loaded it on Jul 31, 2018.
What to do
- If you had a Fashion Nexus account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
