Ster-Kinekor data breach
From Breaches, in the HARD wiki · Updated
This article is about the March 2017 breach of Ster-Kinekor. For every breach, see Breaches.
The Ster-Kinekor data breach exposed 1,619,544 accounts from sterkinekor.co.za in March 2017. The data taken includes passwords, dates of birth, names and physical addresses and 4 more kinds of data.[1]
Have I Been Pwned verified it and added it to its search on 13 Mar 2017, within a month. It is the 333rd largest of the 618 breaches in HARD’s list.
What was exposed
Ster-Kinekor’s breach included 8 kinds of data. What each lets criminals do:
| Data | What it’s used for |
|---|---|
| Passwords | Criminals try leaked passwords on email, banking and shopping sites, because people reuse them. |
| Dates of birth | Used to prove who you are to banks and phone companies. |
| Names | Makes scam messages personal enough to believe. |
| Physical addresses | Used to prove who you are, and for scam letters and parcels. |
| Email addresses | Expect scam emails that name the company to look genuine. |
| Phone numbers | Expect scam texts and calls, and a higher risk of someone moving your number to their SIM. |
| Genders | Personal details that make scam messages more convincing. |
| Spoken languages | Personal details that make scam messages more convincing. |
What to do
- Check whether you’re in it.Search your email address on Have I Been Pwned. It tells you which breaches it appears in, Ster-Kinekor among them, without showing the data.
- Change your Ster-Kinekor password.If the account still exists, sign in at Ster-Kinekor (sterkinekor.co.za) and change it.
- Change it anywhere you used the same one.Start with your email, then banking and shopping. Leaked passwords are tried on other sites automatically, within days.
- Use a password manager and two-step sign-in.A different password for every site means one breach can’t open the rest. Two-step sign-in stops a leaked password working on its own.
- Distrust messages that mention Ster-Kinekor.Scammers use breach data to sound genuine. Don’t click links in emails or texts about the breach; go to the site yourself.
- Put a PIN on your phone account.Ask your mobile provider for a port-out PIN, so no one can move your number to their SIM.
- Freeze your credit.In the US, free at Equifax, Experian and TransUnion. In Australia, ask Equifax, Experian and illion for a ban. No one can open credit in your name while it’s on.
Timeline
- : the breach, as best it can be dated.
- : Have I Been Pwned verifies the data and adds it to its search, within a month.
Similar breaches
Breaches that leaked the same kinds of data, closest in time:
- Fashion Nexus, July 2018, 1.3 million accounts
- ClearVoice Surveys, August 2015, 15 million accounts
- EatStreet, May 2019, 6.4 million accounts
- bigbasket, October 2020, 25 million accounts
- Dave, June 2020, 3 million accounts
- MMG Fusion, December 2020, 2.7 million accounts
See Breaches for all 618, and Updates for keeping your devices patched.
References
- ^ Troy Hunt. “Ster-Kinekor”, Have I Been Pwned, added 13 Mar 2017. Breach data licensed CC BY 4.0.
External links
- Have I Been Pwned, to check your email address
- sterkinekor.co.za, Ster-Kinekor’s website