Hacker selling 40 million user records from popular Wishbone app

guest · May 20, 2020

Hacker selling 40 million user records from popular Wishbone app
May 20, 2020
https://www.zdnet.com/article/hacker-selling-40-million-user-records-from-popular-wishbone-app/

A hacker has put up for sale today the details of 40 million users registered on Wishbone, a popular mobile app that lets users compare two items in a simple voting poll.

The data is being advertised across multiple hacking forums and being sold for 0.85 bitcoin (~$8000), according to ads seen by ZDNet.
According to the seller's claims and a sample of the data published online, the Wishbone data includes user information such as usernames, emails, phone numbers, city/state/country, but also hashed passwords.

The hacker claims the passwords are in the SHA1 format; however the sample that ZDNet reviewed today contained passwords in MD5.
Click to expand...

WISHBONE HACK TOOK PLACE EARLIER THIS YEAR
The seller claims the Wishbone app data was obtained in a hack that took place earlier this year. User registration and last login dates included in the Wishbone data sample appear to confirm this statement, with all timestamps dating to January 2020.

According to ads seen by ZDNet, this threat actor is currently selling databases from tens of other companies, totaling more than 1.5 billion records.
Click to expand...

None of the accounts included in the sample shared today were included in the 2017 Wishbone breach, confirming that these are new accounts, and this is a new hack.

"Protecting data is of the utmost importance," the company said. "We are investigating this matter and will share any significant developments."
Click to expand...

Minimalist · May 21, 2020

Hacker shares 40 million Wishbone user records for free

A hacker has leaked 40 million Wishbone user records that contain a treasure trove of information that could be used to perform phishing campaigns, account takeovers, and credential stuffing attacks.

BleepingComputer has been able to independently confirm that the data is legitimate as it contains user records for people we know have used the app and who have confirmed the accuracy of the data.
Click to expand...

https://www.bleepingcomputer.com/ne...es-40-million-wishbone-user-records-for-free/

guest · May 28, 2020

Data has been added to Have I Been Pwned:

Wishbone (2020) – 9,705,172 breached accounts

Wishbone (2020)
In January 2020, the mobile app to "compare anything" Wishbone suffered another data breach which followed their breach from 2016. An extensive amount of personal information including almost 10M unique email addresses alongside names, phone numbers geographic locations and other personal attributes were leaked online and extensively redistributed. Passwords stored as unsalted MD5 hashes were also included in the breach. The data was provided to HIBP by a source who requested it be attributed to "All3in".

Breach date: 27 January 2020
Date added to HIBP: 28 May 2020
Compromised accounts: 9,705,172
Compromised data: Auth tokens, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords, Phone numbers, Profile photos, Social media profiles, Usernames
Permalink
Click to expand...

Log in or Sign up

Hacker selling 40 million user records from popular Wishbone app

guest Guest

Minimalist Registered Member

guest Guest

Log in or Sign up

Hacker selling 40 million user records from popular Wishbone app

guest Guest

Minimalist Registered Member

guest Guest

Useful Searches