Havenly discloses data breach after 1.3M accounts leaked online


Havenly, a US-based interior design web site, has disclosed a data breach after a hacker posted a database containing 1.3 million user records for free on a hacker forum.

Havenly is an online interior design and home decoration site where users can get help designing a room in their house from certified designers.

Last week, BleepingComputer reported that the ShinyHunters hacking group had leaked the databases for 18 companies on a hacker forum for free. These databases contained a combined total of 386 million user records.

One of the leaked databases contained 1.3 million user records for Havenly.com. 

Havenly database leaked on a hacker forum
Havenly database leaked on a hacker forum

From the samples of this database seen by BleepingComputer, the leaked data included a user’s login name, full name, MD5 hashed password, email address, phone number, zip, and various other data related to the usage of the site.

Sample of the leaked Havenly user database
Sample of the leaked Havenly user database

On July 27th, BleepingComputer contacted Havenly to report the data breach but had not received a reply to our inquiry.

Yesterday, five days after we sent our email, Havenly officially disclosed the data breach and are emailing notifications to users.

Havenly issues data breach notification

Havenly is sending out data breach notifications stating that they “recently became aware of a potential incident” and performed a mandatory reset of all passwords.

“We take the security of our community very seriously. As a precaution, we wanted to let you know that we recently became aware of a potential incident that may have affected the security of certain customer accounts. We are working with external security experts to investigate this matter.”

“However, in the meantime, out of an abundance of caution, we are logging all existing customers out of their Havenly accounts and asking our customers to reset their password when they next log in to the Havenly website. As a best practice, we also encourage all of our customers to use different passwords across all online services and applications, and to update those passwords now and on a regular basis,” Havenly’s data breach notification stated.

Havenly stated that they do not store complete credit card information, and only the last four digits may have been exposed.

“We suspect that many of you will be concerned about the credit card numbers that you’ve used with Havenly in the past. Please note: we do NOT store credit card information, apart from the last 4 digits of the card in some cases, which is not enough to engage in credit card fraud,” Havenly disclosed.

In the limited sample seen by BleepingComputer, we did not see any credit card information, including the last four digits.

If you are concerned that your account was part of this data breach, Have I Been Pwned has added Havenly to their data breach lookup service, and you can use it to check if your email address was involved.

What Havenly customers should do

While the passwords leaked in this data breach were hashed, it is still possible for threat actors to decrypt the password.

After a user’s password is cracked, threat actors would be able to use them to try and login at other sites you may have an account.

Therefore, if you are a Havenly customer, you should immediately change your password to a strong and unique one.

If that same password was used at another site, you should change it at any other site that also uses it.

When changing your passwords, be sure to use a unique and strong password at every site so that a data breach does not affect your account at other companies.

A password manager can make it much easier to use unique passwords at every site and is highly recommended.

Source link

Recent articles

How to Get Great Photos of the Character Cavalcades at Walt Disney World

Currently, the only way you can see and photograph Disney characters at Walt Disney World is during the many Character Cavalcades at each...

South African mobile recruitment platform Giraffe wants to get young people back to work

After months of being ignored by recruiters in her home country of South Africa, the economics graduate began using a recruitment website called...

Solar cell concept used to enhance nuclear battery | Research

Researchers in South Korea and the US have borrowed a strategy traditionally used in photovoltaic devices to enhance a battery concept that generates...

Vauxhall Motors launches new “confidently British” logo

British carmaker Vauxhall has revealed a flat, minimal version of its griffin emblem to replace its three-dimensional logo that had a metallic look.Opting for a "cleaner" and...

Hounded in the US, TikTok is also facing scrutiny in Australia | Australia News

The video-sharing app has downplayed links between its parent company, ByteDance, and the Chinese Communist Party.TikTok executives sought to reassure Australian lawmakers on...

Leave a reply

Please enter your comment!
Please enter your name here