Havenly discloses data breach after 1.3M accounts leaked online

Havenly, a US-based interior design web site, has disclosed a data breach after a hacker posted a database containing 1.3 million user records for free on a hacker forum.

Havenly is an online interior design and home decoration site where users can get help designing a room in their house from certified designers.

Last week, BleepingComputer reported that the ShinyHunters hacking group had leaked the databases for 18 companies on a hacker forum for free. These databases contained a combined total of 386 million user records.

One of the leaked databases contained 1.3 million user records for Havenly.com. 

Havenly database leaked on a hacker forum

From the samples of this database seen by BleepingComputer, the leaked data included a user's login name, full name, MD5 hashed password, email address, phone number, zip, and various other data related to the usage of the site.

Sample of the leaked Havenly user database

On July 27th, BleepingComputer contacted Havenly to report the data breach but had not responded to our inquiry.

Yesterday, five days after we sent our email, Havenly officially disclosed the data breach and are emailing notifications to users.

Havenly issues data breach notification

Havenly is sending out data breach notifications stating that they "recently became aware of a potential incident" and performed a mandatory reset of all passwords.

"We take the security of our community very seriously. As a precaution, we wanted to let you know that we recently became aware of a potential incident that may have affected the security of certain customer accounts. We are working with external security experts to investigate this matter."

"However, in the meantime, out of an abundance of caution, we are logging all existing customers out of their Havenly accounts and asking our customers to reset their password when they next log in to the Havenly website. As a best practice, we also encourage all of our customers to use different passwords across all online services and applications, and to update those passwords now and on a regular basis," Havenly's data breach notification stated.

Havenly stated that they do not store complete credit card information, and only the last four digits may have been exposed.

"We suspect that many of you will be concerned about the credit card numbers that you've used with Havenly in the past. Please note: we do NOT store credit card information, apart from the last 4 digits of the card in some cases, which is not enough to engage in credit card fraud," Havenly disclosed.

In the limited sample seen by BleepingComputer, we did not see any credit card information, including the last four digits.

If you are concerned that your account was part of this data breach, Have I Been Pwned has added Havenly to their data breach lookup service, and you can use it to check if your email address was involved.

What Havenly customers should do

While the passwords leaked in this data breach were hashed, it is still possible for threat actors to decrypt the password.

After a user's password is cracked, threat actors would be able to use them to try and login at other sites you may have an account.

Therefore, if you are a Havenly customer, you should immediately change your password to a strong and unique one.

If that same password was used at another site, you should change it at any other site that also uses it.

When changing your passwords, be sure to use a unique and strong password at every site so that a data breach does not affect your account at other companies.

A password manager can make it much easier to use unique passwords at every site and is highly recommended.