FlexBooker
December 23, 2021
•[ hack, misconfiguration, technology ]
In December 2021, the online booking service FlexBooker suffered a data breach that exposed 3.7 million accounts. The data included email addresses, names, phone numbers and for a small number of accounts, password hashes and partial credit card data. FlexBooker has identified the breach as originating from a compromised account within their AWS infrastructure. The data was found being actively traded on a popular hacking forum and was provided to HIBP by a source who requested it be attributed to "white_peacock@riseup.net".
Belgium's Ministry of Defense
December 16, 2021
•[ hack, misconfiguration, government ]
Belgium's Ministry of Denfense is hit by a cyberattack, attackers exploit CVE-2021-44228. Log4j, vulnerability.
VulcanForge
December 13, 2021
•[ hack, misconfiguration, finance ]
Cryptocurrency gaming platform is hacked, hackers compromise private keys of 96 wallets and steal approximately $135 million.
Pace Center for Girls
December 13, 2021
•[ hack, misconfiguration, education ]
Florida education program for at risk teenage girls experiences unauthorized access to servers compromising student data.
Jefferson Health
November 18, 2021
•[ hack, misconfiguration, healthcare ]
The personal information of over 9,000 Jefferson Health patients is compromised by unauthorized access to its online insurance portal.
UT Air
November 9, 2021
•[ leak, misconfiguration, transportation ]
Database of clients of the Russian air carrier utair in the database there are phone numbers and addresses of famous Russian senators
Stripchat
November 5, 2021
•[ leak, misconfiguration, technology ]
In November 2021, the live sex cams and adult chat website Stripchat left several databases exposed and unsecured. In June the following year, over 10M Stripchat records appeared on a popular hacking forum. The exposed data included usernames, email addresses and IP addresses.
Massachusetts Interscholastic Athletic Association
November 1, 2021
•[ hack, misconfiguration, government ]
Massachusetts athletic associate website is defaced.
Fantasy Football Hub
October 3, 2021
•[ hack, misconfiguration, technology ]
Fantasy Football Hub suffers data breach via comromised WordPress administrator dashboard.
Fantasy Football Hub
October 2, 2021
•[ hack, misconfiguration, technology ]
In October 2021, the fantasy premier league (soccer) website Fantasy Football Hub suffered a data breach that exposed 66 thousand unique email addresses. The data included names, usernames, IP addresses, transactions and passwords stored as WordPress MD5 hashes.
Fitmart
October 1, 2021
•[ leak, misconfiguration, retail ]
In October 2021, data from the German fitness supplies store Fitmart was obtained and later redistributed online. The data included 214k unique email addresses accompanied by plain text passwords, allegedly "dehashed" from the original stored version.
Marshall & Melhorn
September 14, 2021
•[ hack, misconfiguration ]
Marshall & Melhorn files a notice of data breach after determining that an unauthorized party was able to access confidential information stored on the firm's IT network.
Brazil's National Health Surveillance Agency
September 9, 2021
•[ hack, misconfiguration, government ]
The website of Brazil's National Health Surveillance Agency is defaced in an apparent protest against the suspension of a World Cup qualifing match.
Seneca Family of Agencies
August 25, 2021
•[ hack, misconfiguration, healthcare ]
California health and social services provider suffers unauthorized network access compromising protected health information of nearly 20,000 individuals.
DatPiff
August 25, 2021
•[ leak, misconfiguration, technology ]
In late 2021, email address and plain text password pairs from the rap mixtape website DatPiff appeared for sale on a popular hacking forum. The data allegedly dated back to an earlier breach and in total, contained almost 7.5M email addresses and cracked password pairs. The original data source allegedly contained usernames, security questions and answers and passwords stored as MD5 hashes with a static salt.
Imavex
August 20, 2021
•[ hack, misconfiguration, technology ]
In August 2021, the website development company Imavex suffered a data breach that exposed 878 thousand unique email addresses. The data included user records containing names, usernames and password material with some records also containing genders and partial credit card data, including the last 4 digits of the card and expiry date. Hundreds of thousands of form submissions and orders via Imavex customers were also exposed and contained further personal information of submitters and the contents of the form. The compromised system was subsequently sunset in January 2024 and all customer data impacted by the incident was permanently deleted.
AT&T
August 20, 2021
•[ hack, misconfiguration, technology ]
In March 2024, tens of millions of records allegedly breached from AT&T were posted to a popular hacking forum. Dating back to August 2021, the data was originally posted for sale before later being freely released. At the time, AT&T maintained that there had not been a breach of their systems and that the data originated from elsewhere. 12 days later, AT&T acknowledged that data fields specific to them were in the breach and that it was not yet known whether the breach occurred at their end or that of a vendor. AT&T also proceeded to reset customer account passcodes, an indicator that there was sufficient belief passcodes had been compromised. The incident exposed names, email and physical addresses, dates of birth, phone numbers and US social security numbers.
Open Subtitles
August 1, 2021
•[ ransomware, misconfiguration, technology ]
In August 2021, the subtitling website Open Subtitles suffered a data breach and subsequent ransom demand. The breach exposed almost 7M subscribers' personal data including email and IP addresses, usernames, the country of the user and passwords stored as unsalted MD5 hashes.
Educators Mutual Insurance Association
July 29, 2021
•[ hack, misconfiguration, finance ]
Educators Mutual Insurance Associate discovers unauthorized network access potentially compromising protected health information of its members.
AndroidLista
July 28, 2021
•[ hack, misconfiguration, technology ]
In July 2021, the Android applications and games review site AndroidLista suffered a data breach. The incident exposed 6.6M user records containing email addresses, names, usernames and passwords stored as salted SHA-1 hashes, all of which were subsequently posted to a popular hacking forum. AndroidLista did not respond when contacted about the breach.
