[BreachExchange] DatPiff breach exposes passwords, user names of 7.5 million music lovers

[Terrell Byrd]

https://www.bitdefender.com/blog/hotforsecurity/datpiff-breach-exposes-passwords-user-names-of-7-5-million-music-lovers/

A database containing 7.5 million DatPiff user records has been made
public, entirely for free, on a popular Dark Web hacking forum. According
to Haveibeenpwned, the 7,476,940 member records include user email
addresses, usernames, security questions and plain-text passwords.

DatPiff, launched in the US in 2005, is a popular music online distribution
platform with over 15 million users. It specializes in hip-hop, rap and
urban music mixtapes and lets unregistered users download mixtapes
sponsored by the artists for free. Registered users are permitted a limited
number of downloads of non-sponsored mixtapes per day, while paying users
have an unlimited number of downloads of any mixtape.

While the data leak that affected DatPiff dates to at least 2020, as the
same database has been traded on hacking forums in July and November 2020,
this is the first time it’s been distributed freely with plain-text
passwords. This follows a classic pattern for data stolen in data breaches.
The information is first sold privately to the highest bidder, than
publicly to anyone and then, finally, dumped freely, as the original seller
has lost interest in it.

This is both good and bad news for DataPiff users affected by the data
leak. As the information isn’t new and is thought to come from an old
database backup, not from the actual DatPiff website, most users have had
time to change their compromised credentials. However, a number of users
could still be exposed. Additionally, because emails and passwords in plain
text are available to virtually anyone, even users that changed their
credentials can be targeted by an increase in attacks in the following
period.

As people casually use the same password and security answers on multiple
accounts, including their e-mail account and social media accounts, the
biggest concern with this leak is that hackers could use the freely
obtained information to hijack other user accounts.

To protect your online accounts, you should always:

Change your password immediately if it’s been exposed in a data leak
Always use complex and unique passwords for all your accounts; longer is
better (you can always use a password manager to generate random passwords
and store them safely)
Enable multi-factor authentication on your accounts.
Keep track of your online footprint. A good way to check if any of your
personal information has been leaked is by using Bitdefender Digital
Identity Protection (DIP). DIP alerts you in real time if any of your
online accounts have been exposed in a data breach. It shows you exactly
what the Internet knows about you and helps you secure your digital
identity from cybercriminals.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20220106/795c124a/attachment.html>