Are you an E-Toro customers? You need to read this

[cryptomaniac_xxx]

And we all know that E-Toro has a platform that includes crypto trading. And there are news that someone is selling E-Toro accounts in hackers forum.



So just to be in the safe side, better change your password now.

Cheap eToro accounts
Using the alias “Sheriff,” the actor advertised on July 6 an auction for 62,000 accounts belonging to users of the eToro social trading platform.

The offer included login credentials, phone numbers, postal addresses, and balances for a starting price of $1,500. Each new bid would increase the price by $500, with the highest bidder winning the auction.

The researcher says that this second seller has a long list of offers for accounts for payment/money transfer systems, cryptocurrency exchange and online trading platforms.

Previous posts advertise accounts for Advcash, Azimo, Binance, Bitcan, Coinmama, Coinsbank, Neteller, OKPAY, Payoneer, Paypal, Skrill, Yandex Money, Webmoney, Qiwi, along with many others.

https://www.bleepingcomputer.com/news/security/etoro-accounts-peddled-by-the-thousands-on-cybercrime-forums/

[OcTradism]

What's up? It is not new in life.

Don't buy any account on any platform (the forum, P2P marketplaces, exchanges, emails, PayPal, etc.) if you don't want to get annoying troubles, sometimes with financial loses or jail punishments. Who knows?

From the start, people choose to do this (buying accounts) because they want to do something shady and they believe or hope that there will be nothing bad knocks their doors. Such a life, sometimes their doors will be knocked without invitations.

[Lordhermes]

Thanks op for great information, account privacy and security Ian important factor to consider, not only changing password but setting up 2FA, SMS, Email and other security factors are mandatory now. Buying accounts is not new in the crypto space and i will never advise any users to develop such act of purchasing account because penalties and other form of punishment may be attached in future. You might not know.

[coupable]

Thanks OP for sharing such a great information.

What's up? It is not new in life.

Don't buy any account on any platform (the forum, P2P marketplaces, exchanges, emails, PayPal, etc.) if you don't want to get annoying troubles, sometimes with financial loses or jail punishments. Who knows?

It's not only about warning people how much it's risky to buy stolen accounts. An auction for 62,000 accounts belonging to E-toro users is a horrible news. This leads me to think on how all those accounts have been stolen, and that someone reading this may must have his account compromised. This is why op adviced users to change their login info.

[Pamadar]

It's not only about warning people how much it's risky to buy stolen accounts.

Most people who understand this business will never buy account knowing the risk that they might be compromised.

An auction for 62,000 accounts belonging to E-toro users is a horrible news.

This is indeed a catching news with that huge numbers of compromised accounts that are involved from this hacking news.

This leads me to think on how all those accounts have been stolen, and that someone reading this may must have his account compromised.

If you are using this platform the first that comes in your mind is the chance that you are one from those huge list.

This is why op adviced users to change their login info.

Alarming every users of E-Toro will help them to check out and secure their account by changing password and dding security measures.

[hugeblack]

The auction date starts on July 6, so it has been around a week without the platform announcing that it has been hacked or that something has happened.
It will be a moral failure for them if they do not know about hacking, and it will be worse if they know.

It is a good idea to change the password, but if there any hack reported in the coming days, stop using it because they are either lazy or liars.

What is the credibility of the above-mentioned hacker forum?

[btc_angela]

What's up? It is not new in life.

Don't buy any account on any platform (the forum, P2P marketplaces, exchanges, emails, PayPal, etc.) if you don't want to get annoying troubles, sometimes with financial loses or jail punishments. Who knows?

From the start, people choose to do this (buying accounts) because they want to do something shady and they believe or hope that there will be nothing bad knocks their doors. Such a life, sometimes their doors will be knocked without invitations.

I think you misunderstood what the intentions of the OP in sharing this. It's not about buying an account in any platform. It is simply to make aware that if you are an E-Toro customers or you have an account with them, most likely it has been compromise already and your account are being sold in dark web or dark market so as a preventive measures, you must change your password now.

[TravelMug]

I'm not sure if E-Toro already recognised this hacked or supposedly hacked. But based on the article the hackers have started to make a name for himself and even getting hired by other group of hackers to get him onboard because he has been hacking a lot and being successful.

And E-Toro I would say is getting some noise in the last couple of years, specially with their copy-trading. So maybe there are crypto traders here who have an account with them and they could be a potential victims if this hacking is real.

[Findingnemo]

I'm not sure if E-Toro already recognised this hacked or supposedly hacked. But based on the article the hackers have started to make a name for himself and even getting hired by other group of hackers to get him onboard because he has been hacking a lot and being successful.

And E-Toro I would say is getting some noise in the last couple of years, specially with their copy-trading. So maybe there are crypto traders here who have an account with them and they could be a potential victims if this hacking is real.

Even google is promoting their copy trading advertisement on various platform so yes there will be lot of new people entered into the site for trading activities.But how such amount of accounts can be stolen, is the database got leaked or they used to hack individuals.

[joniboini]

Even google is promoting their copy trading advertisement on various platform so yes there will be lot of new people entered into the site for trading activities.

Well, if they paid for it then I guess it's expected.

Regardless of whether this hack is true or not, companies should improve their security such as moving from old plain-text databases or simple encryption. Implementing 2FA should be mandatory with an IP check. Assuming their users are doing good security practice, this is at least what they can do to prevent another attack whithin a short time frame.

[cryptomaniac_xxx]

What is the credibility of the above-mentioned hacker forum?

Usually this cyber threat investigators knows what hacker forums to look at, so I have no doubt that the source forum could really be legit source.

I'm not sure if E-Toro already recognised this hacked or supposedly hacked. But based on the article the hackers have started to make a name for himself and even getting hired by other group of hackers to get him onboard because he has been hacking a lot and being successful.

It's a job for most of this criminals, the hackers could really be making a name in the hacking world and this is his way to be known to his fellow criminals, his career his starting only and it is very scary.

Even google is promoting their copy trading advertisement on various platform so yes there will be lot of new people entered into the site for trading activities.But how such amount of accounts can be stolen, is the database got leaked or they used to hack individuals.

This has nothing to do with Google, if they are getting paid handsomely, they will promote it in their platform even in Youtube.
The best way to combat this one is to update and change your password immediately and then withdraw your money from it.

[Findingnemo]

Even google is promoting their copy trading advertisement on various platform so yes there will be lot of new people entered into the site for trading activities.

Well, if they paid for it then I guess it's expected.

Regardless of whether this hack is true or not, companies should improve their security such as moving from old plain-text databases or simple encryption. Implementing 2FA should be mandatory with an IP check. Assuming their users are doing good security practice, this is at least what they can do to prevent another attack whithin a short time frame.

Having login guard for unauthorized IP addresses could save most of the people from getting hacked even if their account credentials got leaked, 2FA will add one more layer of security to the account but most of the crypto-related sites having poor security encryptions.But they are paying huge amount for advertisement purposes alone.

[Nellayar]

The incident is already being investigated by those responsible for the platform, although experts in secure data erasure recommend potentially affected users to reset their passwords as an additional security measure while resolving this issue.

Those responsible for the attack operate on the deep web, which has become the ideal refuge for cybercrime groups. For years, authorities in dozens of countries have invested considerable efforts in combating clandestine hacking forums housed in this area of the Internet, although it is virtually impossible to stop their advance.

For further reports on vulnerabilities, exploits, malware variants and computer security risks, it is recommended to enter the website of the International Institute of Cyber Security (IICS), as well as the official platforms of technology companies.

For updates, there is already investigation for this data leaking event. It may inflict a bad reputation for E-toro since the privacy and security have been risked. They should make a step on how to detect the user who posted in the said hacking forum.

I do not have yet an account in E-toro and I am currently planning to make a new account. Well, this event might cease me in pursuing to trade in E-toro unless otherwise there is no threat or potential threat in accounts.

For those who will change their passwords:

[GUIDE] How to Create a Strong/Secure Password

This one may help you to create a strong/secure password. Just be vigilant guys and always update your passwords.

reference: https://www.securitynewspaper.com/2020/07/10/data-leaking-hackers-are-selling-62000-accounts-from-etoro-the-online-trading-platform/

[Assface16678]

From the previous months, I'm planning about using the E-toro because this is popular into the world of copy trading which is a good thing to me that someone will make a trade but now I roughly doubt about the things shared by OP because why there are auctions of an account right here and how about the security of their users when they are trying to buy this account there is a KYC right there and how about the information they will use on it.

I'm not sure if E-Toro already recognised this hacked or supposedly hacked. But based on the article the hackers have started to make a name for himself and even getting hired by other group of hackers to get him onboard because he has been hacking a lot and being successful.

And E-Toro I would say is getting some noise in the last couple of years, specially with their copy-trading. So maybe there are crypto traders here who have an account with them and they could be a potential victims if this hacking is real.

Even google is promoting their copy trading advertisement on various platform so yes there will be lot of new people entered into the site for trading activities.But how such amount of accounts can be stolen, is the database got leaked or they used to hack individuals.

It looks like the E-toro does not have a good database management system because there is a leak that came from the other users and spreading all of that information and selling right there. I think they must need to take down this kind of process and make an action immediately.

[LTU_btc]

Thanks for sharing these news. I don't use E-Toro, but it's popular trading platform and I think that many people here use it. And looking at all things in general - reputation of this user in hackers forum, history of other his hacks, it doesn't looks like fake thing.
So, if you're using this platform, changing your passeord is must do thing. Better safe than sorry. And it would be best to set up 2FA if you're not using it already.

[btc_angela]

It looks like the E-toro does not have a good database management system because there is a leak that came from the other users and spreading all of that information and selling right there. I think they must need to take down this kind of process and make an action immediately.

I think crypto trading platforms can only do that much in terms of their security. Because hackers are just two steps on the game right now and the thought that you have an account there that you don't know have been leaked already is really scary. Services that has been attacked are either denying it or acknowledging that there was really a breach. I do hope that E-Toro is the latter and doing some root cause analysis and get someone to strengthen their security, not just their system but the people involved their employees because hackers can target them in a phishing attack as well.

Maybe you need to wait it out before registering on E-Toro mate.

[UserU]

Oh great, saw this earlier on my Twitter feed.

Are Google users affected? By which I mean those using Google to sign in.

[DdmrDdmr]

<...>

When using Google to sign-in to a third-party site, the site does not gain access to your password, but rather Google validates your credentials, and sends a token to the site to manage. Google may also send:

<…> These third-party sites or apps can request the name, email address, and profile picture associated with your account. <…>

https://support.google.com/accounts/answer/112802?co=GENIE.Platform%3DDesktop&hl=en

With the above, eToro (or any other third-party site allowing you to log-in using your Google credentials) may have stored your email, but not your password. I’d use 2FA with my Google account if it were the case.

[UserU]

<...>

When using Google to sign-in to a third-party site, the site does not gain access to your password, but rather Google validates your credentials, and sends a token to the site to manage. Google may also send:

<…> These third-party sites or apps can request the name, email address, and profile picture associated with your account. <…>

https://support.google.com/accounts/answer/112802?co=GENIE.Platform%3DDesktop&hl=en

With the above, eToro (or any other third-party site allowing you to log-in using your Google credentials) may have stored your email, but not your password. I’d use 2FA with my Google account if it were the case.

Thanks, my Google account has 2FA enabled. But unfortunately many sites still haven't integrated Google Sign In so if they get compromised, we're pretty much screwed.

[l3pox]

friendly reminder to keep security practices on all exchanges:
use 2FA
use different passwords (and strong ones)
use different emails for each crypto service (creating a protonmail takes only 2 minutes)
and don't keep money on exchanges without knowing it could be lost or stolen.