{"id":5169,"date":"2018-07-04T04:02:55","date_gmt":"2018-07-04T04:02:55","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/hands-up-if-you-didnt-lose-data-in-the-typeform-breach\/"},"modified":"2018-07-04T04:02:55","modified_gmt":"2018-07-04T04:02:55","slug":"hands-up-if-you-didnt-lose-data-in-the-typeform-breach","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hands-up-if-you-didnt-lose-data-in-the-typeform-breach\/","title":{"rendered":"Hands up if you didn’t<\/i> lose data in the Typeform breach"},"content":{"rendered":"

The list of organisations notifying customers that they’re affected by the Typeform data breach continues to grow \u2013 and at least one victim has publicly claimed the breached backup data was unencrypted.<\/p>\n

Australian bakery chain Bakers Delight, \u201cbeyond banking\u201d outfit Revolut, the Australian Republican Movement, data platform Ocean Protocol, evaluation software company DevResults, digital transformation software vendor PostShift, and England’s Shavington-cum-Gresty Parish Council have all told users they’ve been caught up in the breach.<\/p>\n

In the main, affected organisations are using Typeform’s template, which it prepared<\/a> \u201cfor you to use as part of your communications strategy\u201d, so most of the announcements are close to identical.<\/p>\n

However, the folk at Ocean Protocol departed from the template to include this detail in their breach post<\/a>: \u201cTypeForm has confirmed that the data was stored in an unencrypted manner which means that the data is accessible.\u201d<\/p>\n

In Ocean Protocol’s case, the attacker obtained \u201cemail, birthdate, place of birth, ID number, nationality, wallet address, scans of identity documents, proof of residence, proof of accreditation and for our US participants, SSN\u201d.<\/p>\n

Because of the breadth of its breach, Ocean Protocol is offering credit monitoring to affected customers. Its further advice included:<\/p>\n