Have I Been Pwned owner Troy Hunt’s mailing list compromised in phishing attack

Troy Hunt, the security blogger behind data breach site Have I Been Pwned, has fallen victim to a phishing attack targeting his email subscriber list.

In a blog post disclosing the incident, Hunt described how the attack took place, with screen shots of the phishing email, which purported to come from his email marketing provider, Mailchimp.

The trap used a classic phishing tactic of including a button that linked to a page with a similar url to the legitimate one – mailchimp-sso.com (now deactivated) versus mailchimp.com.

Hunt, who said he was “really jet lagged and really tired” at the time entered his credentials and the one time password (OTP) and the page then hung, rather than loading.

“Moments later, the penny dropped,” Hunt wrote. “I logged onto the official website, which Mailchimp confirmed via a notification email which showed my London IP address.”

“I immediately changed my password, but not before I got an alert about my mailing list being exported from an IP address in New York,” he added.

Hunt himself and others in the industry reacting to the news have said this is an example of how hackers exploit human weaknesses to carry out successful attacks.

In the case of Hunt, tiredness led to lack of attention, which in turn led to him falling for a phishing scam of the kind he said he would typically have recognized early.

Erich Kron, security advocate at KnowBe4, said the incident is a prime example of how even a seasoned cybersecurity veteran can fall prey to cyber criminals.

"Social engineering is largely getting the right message to the right person at the right time, and that combination can lead to unfortunate situations such as this.”

Aditi Gupta, principal security consultant at Black Duck, echoed Kron's comments, noting that bad actors deliberately "feed on fear and weaknesses such as tiredness and a sense of urgency" to bait unsuspecting users.

"This recent phishing attack further highlights that, in the end, we are all humans, and sophisticated phishing attacks could get the best of us."

Kron commended Hunt, adding that he “deserves kudos” for revealing what had happened to him and using the incident as an opportunity to educate others.

For his part, Hunt said he has gone through the usual gamut of emotions felt by someone who falls for a scam, including feeling “so stupid” and acknowledged “[his] own foolishness”.

However, he also hit out at some of Mailchimp's own practices that he claimed are poor in relation to data security. These include not offering phishing-resistant two factor authentication (2FA) and not automatically deleting unsubscribed email addresses.

Hunt concluded his blog post by offering his “sincere apologies to anyone impacted by this”, but added that “on balance I think this will do more good than harm and I encourage everyone to share this experience broadly”.

MORE FROM ITPRO

• Hackers are using this new phishing technique to bypass MFA
• 10 quick tips for identifying phishing emails
• How hackers are using legitimate tools to distribute phishing links