Jason's Deli
January 19, 2024
•[ hack, brute-force, retail ]
Jason's Deli warns of a data breach in notifications sent to customers of its online platform stating that their personal data was exposed in credential stuffing attacks.
Roku
March 15, 2024
•[ hack, brute-force, technology ]
Roku warns that 576,000 accounts were hacked in new credential stuffing attacks after disclosing another incident that compromised 15,000 accounts in early March.
23andMe
October 2, 2023
•[ leak, brute-force, healthcare ]
23andMe confirms to be aware of user data from its platform circulating on hacker forums and attributes the leak to a credential-stuffing attack.
RocketSwap
August 15, 2023
•[ hack, brute-force, finance ]
Decentralized exchange RocketSwap loses $870,000 in a hack due to multiple vulnerabilities, including storing user private keys on its cloud servers via a brute-force attack.
PayPal
December 21, 2022
•[ leak, brute-force, finance ]
PayPal sends out data breach notifications to approximately 35,000 users who had their accounts accessed through credential stuffing attacks that exposed some personal data.
DraftKings
November 21, 2022
•[ hack, brute-force, technology ]
Sports betting company DraftKings reveals that it would make whole customers affected by a credential stuffing attack that led to losses of up to $300,000.
Seesaw
September 14, 2022
•[ hack, brute-force, education ]
Seesaw, a popular messaging application used by school districts across the U.S. is forced to apologize after parents said an inappropriate photo was sent out as a consequence of a credential stuffing attack.
The North Face
July 26, 2022
•[ hack, brute-force, retail ]
Outdoor apparel brand 'The North Face' is targeted in a large-scale credential stuffing attack resulting in the hacking of 194,905 accounts on the thenorthface.com website.
Zola
May 21, 2022
•[ financial, brute-force, retail ]
Wedding registry website Zola confirms that it was hit with a cyberattack after dozens of customers complained on social media about their accounts being drained or breached.
Npower
February 26, 2021
•[ hack, brute-force, energy ]
British energy provider Npower suffers a credential stuffing attack, forcing the company to shut down its mobile app.
Department of Workforce Development in Wisconsin
October 28, 2020
•[ hack, brute-force, government ]
The Wisconsin Department of Workforce Development says that hackers were able to access 116 active unemployment accounts in a credential stuffing attack and divert unemployment insurance payments.
The North Face
October 8, 2020
•[ hack, brute-force, retail ]
The North Face was the victim of a credential stuffing attack in October.
California Employment Development Department
September 10, 2020
•[ financial, hack, brute-force ]
The California Employment Development Department reveals that cyber criminals have been collecting credentials from breaches worldwide to fraudulently collect California unemployment benefits.
GCKey
August 17, 2020
•[ hack, brute-force, government ]
According to a press release issued by the Treasury Board of Canada Secretariat, thousands of user accounts for online government services were recently hacked. The hackers targeted GCKey, a service that is used by some 30 federal departments, with credential stuffing.
Instacart
July 23, 2020
•[ leak, brute-force, retail ]
Online shopping service Instacart says reused passwords are to blame for a recent spate of account breaches, which saw personal data belonging to hundreds of thousands of Instacart customers stolen and put up for sale on the dark web.
Tokopedia
May 3, 2020
•[ hack, brute-force, retail ]
A hacker sells a database containing the information of 91 million Tokopedia accounts on a dark web market for $5,000. Other threat actors start to crack passwords and share them online.
Boots
March 4, 2020
•[ hack, brute-force, retail ]
Boots suspends payments using loyalty points in shops and online after attempts to break into customers' accounts using stolen passwords.
Tesco
March 2, 2020
•[ hack, brute-force, retail ]
Tesco issues new cards to 600,000 Clubcard account holders after a credential stuffing attack.
Australian PayID users
August 26, 2019
•[ hack, brute-force, finance ]
Tens of thousands of Australians have had their personal banking information hacked by fraudsters, after fraudulent accounts worked to generate a series of random numbers and retrieve the victims' PayID details.
Transport for London (TfL)
August 8, 2019
•[ hack, brute-force, government ]
Transport for London (TfL) is forced to temporarily suspend the website for its Oyster system after an apparent credential stuffing attack on customers.
