Cyber Incident Victim: Havenly
Date:
Jul 2020
Location:
United States of America
Summary
A Denver-based interior design marketplace experienced a data breach when threat actors leaked approximately 1.3 million user records online. The compromised information included login credentials, full names, MD5-hashed passwords, email addresses, phone numbers, and zip codes, though financial data remained largely unaffected as only partial credit card digits were stored. The organization responded by initiating forced password resets, engaging external security experts, and notifying impacted individuals. Users were advised to verify exposure through a breach notification service and update credentials across other platforms to mitigate credential stuffing risks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Havenly, a Denver-based interior design marketplace, disclosed a data breach on August 3, 2020, following the leak of 1.3 million user records by the threat actor ShinyHunters. The breach occurred when ShinyHunters publicly released the stolen database on a hacker forum as part of a larger dump involving eighteen companies and over 386 million user records. Nine of these databases, including Havenly’s, were newly released at the time, while the remaining nine had been previously leaked by the same actor. The compromised data included login names, full names, MD5 hashed passwords, email addresses, phone numbers, zip codes, and other unspecified user information. Havenly became aware of the incident after BleepingComputer reported ShinyHunters’ forum activity involving multiple company databases. The company confirmed no full credit card details were exposed, as it only stored the last four digits of cards in some cases, which it stated were insufficient for fraud.
In response to the breach, Havenly initiated a forced password reset for all existing customers, logging them out of their accounts and requiring new credentials upon next login. The company notified affected users via email, acknowledging the incident and its engagement with external security experts to investigate. It advised customers to change passwords on other platforms where they reused Havenly credentials to prevent credential stuffing attacks. Users were directed to the Have I Been Pwned service to verify if their data was compromised. Havenly emphasized its commitment to security but provided no specifics on the breach’s timeline, intrusion methods, or whether systems were fully secured post-incident. The disclosure highlighted the exposure of personal identifiers while downplaying financial risks due to limited card data storage. No system downtime or operational disruptions were reported in the announcement.