Wishbone (2020) data breach: 9.7M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2020-05-28
In January 2020, the mobile app to "compare anything" Wishbone suffered another data breach which followed their breach from 2016. An extensive amount of personal information including almost 10M unique email addresses alongside names, phone numbers geographic locations and other personal attributes were leaked online and extensively redistributed. Passwords stored as unsalted MD5 hashes were also included in the breach. Exposed data: auth tokens, dates of birth, email addresses, genders, geographic locations, ip addresses, names, passwords, phone numbers, profile photos, social media profiles, usernames. The breach dates from Jan 27, 2020; Have I Been Pwned loaded it on May 28, 2020.
What to do
- If you had a Wishbone (2020) account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
