Cybercrooks Target Fishbrain to Steal Password Hashes
Cybercrooks Target Fishbrain to Steal Password Hashes
Armed with password hashes and salts, attackers could already be kraken those credentials! 🦑
Cybercriminals have reeled in password hashes and corresponding salts belonging to users of the popular fishing app Fishbrain, opening the door to cracking attempts. Fishbrain AB, which serves more than 20 million anglers, disclosed the breach that occurred on August 19 to the California Attorney General’s Office this week.
The unknown perpetrators accessed a trawl of user data, including:
- Names
- Dates of birth
- Email addresses
- Phone numbers
- Fishbrain usernames
- Country information
- Password hashes and salts
Although Fishbrain passwords were not stored in plaintext, the company has determined that the compromised password hashes for some users may be susceptible to being decoded. With the hashes and salts in hand, attackers can make password guesses using their own hardware until they potentially recover the original credentials. The success of these attempts depends on the strength of each password and the hashing algorithm used, which Fishbrain has not disclosed.
After discovering the intrusion and conducting an initial forensic investigation, Fishbrain patched the vulnerability and reset every user’s password. Customers must create a new password the next time they log in. Fishbrain also stated that it restricted access to the affected environment, strengthened its security controls, and initiated a broader review of their data security measures while the investigation continues.
The company added: “If you use your Fishbrain password for any other online accounts, you should promptly update those passwords and any associated security questions or answers. You should also take other appropriate steps to protect any online accounts that use the same username or email address and password combination. We recommend using a strong, unique password for each of your accounts.” 🔒