Zola wedding registry accounts hacked, company refuses to bring in 2FA

Cybercriminals were able to gain access to a number of user accounts at wedding planner website Zola, hijacking them to try and purchase gift vouchers, the company has confirmed.

The news first popped up on social media as Zola users took to Twitter and Reddit to notify others of unauthorized account access, and multiple attempts at making purchases.

Others found compromised Zola accounts for sale on the black market, but the company was quick to play down the seriousness of the news. 

Credential stuffing and weak passwords

“We understand the disruption and stress that this caused some of our couples, but we are happy to report that all attempted fraudulent cash fund transfer attempts were blocked,” said Emily Forrest, Zola director of communications. “Credit cards and bank info were never exposed and continue to be protected.”

Zola’s infrastructure and endpoints (opens in new tab) were apparently not breached, with the criminals using a credential stuffing technique, in which the attackers try numerous username/password combinations, until one sticks. Credential stuffing usually works on victims who use the same username/password combination across a multitude of services.

Forrest added that the company spotted a number of fraudulent gift card orders and that it’s currently addressing the issue, noting that less than 0.1% of accounts were affected. 

However Zola did confirm it had reset all user passwords after learning of the breach. Mobile apps for both platforms were also disabled during the incident, but have since been reactivated.

Despite the ability to link bank accounts with that on Zola, the latter does not provide any secondary authentication feature, such as an app for two-factor authentication (2FA (opens in new tab)), security keys, and the like. That, TechCrunch argues, makes credential stuffing attacks easier to pull off. 

Security experts will usually recommend creating a strong, unique password for every service. While that may sound like a major nuisance, a good password manager can take away all of the annoyance of managing numerous unique passwords. 

Via: The Verge (opens in new tab)