Intuit

Financial software company Intuit discovered that tax return info was accessed by an unauthorized party after an undisclosed number of TurboTax tax preparation software accounts were breached in a credential-stuffing attack.

Following the discovery of the security breach, Intuit decided to temporarily disable the TurboTax accounts which were breached in the credential stuffing attack.

The company also provides one year of free identity protection, credit monitoring, and Experian Identity Works identity restoration services to customers impacted by the data breach to further protect their TurboTax accounts.

The company stated that there was no data breach of Intuit’s systems or any third party accessing Intuit systems.

Source: https://www.bleepingcomputer.com/news/security/tax-returns-exposed-in-turbotax-credential-stuffing-attacks/

TPRM report: https://scoringcyber.rankiteo.com/company/intuit

"id": "int41916223",
"linkid": "intuit",
"type": "Breach",
"date": "02/2019",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'industry': 'Financial Services',
                        'name': 'Intuit',
                        'type': 'Financial Software Company'}],
 'attack_vector': 'Credential-Stuffing',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Tax return information'},
 'description': 'Financial software company Intuit discovered that tax return '
                'info was accessed by an unauthorized party after an '
                'undisclosed number of TurboTax tax preparation software '
                'accounts were breached in a credential-stuffing attack.',
 'impact': {'data_compromised': 'Tax return information',
            'identity_theft_risk': 'High',
            'systems_affected': 'TurboTax accounts'},
 'initial_access_broker': {'entry_point': 'Credential-Stuffing'},
 'motivation': 'Unauthorized access to sensitive tax return information',
 'post_incident_analysis': {'root_causes': 'Weak or reused passwords'},
 'response': {'containment_measures': 'Temporarily disabling the compromised '
                                      'TurboTax accounts',
              'recovery_measures': 'Providing one year of free identity '
                                   'protection, credit monitoring, and '
                                   'Experian Identity Works identity '
                                   'restoration services to impacted '
                                   'customers'},
 'title': 'TurboTax Credential-Stuffing Attack',
 'type': 'Credential-Stuffing Attack',
 'vulnerability_exploited': 'Weak or reused passwords'}