Havenly, a US- based interior design company, has revealed that it suffered a data breach after a hacker known as “ShinyHunters” leaked a database containing over 1 million user records on a hacking forum . Last week, news broke that the hacker had leaked the databases of 18 companies. One of the leaked databases includes 1.3 million user records for Havenly.com . The data leaked included a user’s login name, full name, MD5 hash of their password, email address, phone number, zip code, and various other data related to their use of the site .
Havenly, while initially refusing to confirm that it had suffered a data breach, now appears to be confirming the news, as it is sending notifications to its site users via email. Specifically, the email states that an incident recently occurred, which may be related to a breach, and so the site performed a mandatory reset of all access passwords.
Additionally, the site team states the following in the email:
“We take the security of our community very seriously. As a precaution, we would like to inform you that we recently discovered an incident that may have impacted the security of some customer accounts. We are working with external security experts to investigate this issue. However, out of an abundance of caution, we are disconnecting all existing customers from their Havenly.com accounts and asking them to reset their passwords when they reconnect to the site. As a best practice, we encourage all of our customers to use different passwords across all online services and applications and to update these passwords regularly.”
Havenly.com also stated that it does not store full credit card details of its users and that only the last four digits of them may have been exposed.
What should Havenly customers do?
While the passwords leaked in the data breach were hashed, it is still possible for hackers to decrypt the password. Once a user’s password is “cracked,” hackers could use it to log in to other sites where a user may have an account. Therefore, Havenly customers should immediately change their passwords and set a strong and unique password. If they used the same password on another site, they should change it there as well.
When they change their password, they should make sure they use a unique and strong password on each site, so that a data breach does not affect their account at other companies. Finally, using a password manager is recommended, as it can make it easier to use unique passwords on each site.
