Connect with Us!
Subscribe to receive new blog post from PureID in your mail box
Zello Faces Another Potential Data Breach, Urges Precautionary Measures
Introduction
Zello, the widely-used push-to-talk app, is once again under scrutiny for its handling of user security. Recently, the company required users to reset their passwords, citing concerns that point to either a credential-stuffing attack or a potential data breach. With 175 million users spanning sectors like emergency response and hospitality, this incident has raised significant questions about the platform’s security measures.
What Happened?
On November 15, 2024, Zello warned users whose account creation date was before November 2nd to change their password. While the exact incident is not known, evidence suggests that:
- Possible Breach: Customer credentials may have been accessed by unauthorized users.
- Credential-Stuffing Attack: Threat actors might be using passwords compromised earlier to gain access.
This measure aims to mitigate risks to affected accounts.
Breaches History at Zello
In 2020, Zello faced a similar challenge:
Data Breach in 2020:
- Unauthorized activity on a server led to the exposure of email addresses and hashed passwords.
- Zello required password resets and asked users not to reuse passwords across platforms.
While the company achieved ISO 27001 certification in September 2024—a certification enforcing strict information security procedures—the recurrence of such incidents questions the strength of Zello's defenses.
The Implications
If confirmed, such a breach or an attack might empower cybercriminals to:
- Steal Credentials: Access account data for unauthorized use.
- Expand Attacks: Use cracked passwords for credential-stuffing attacks on other platforms.
- Expose Sensitive Operations: With Zello used by first responders and other critical sectors, data misuse could disrupt essential services.
What Users Should Do
Zello users should take the following steps to safeguard their accounts immediately:
- Reset Passwords: Change passwords immediately for accounts created before November 2, 2024.
- Use Unique Passwords: Avoid reusing passwords across different services.
- Enable Security Tools: Consider using password managers to generate strong, unique passwords.
With passwordless solutions like PureAuth, organizations can eliminate vulnerabilities altogether, ensuring security by design and default.
Conclusion
The latest security incident at Zello serves as a grim reminder of the changing cyber threats that organizations face. Though breaches may not always be avoidable, proactive measures like enforcing password resets and adopting robust access management solutions can go a long way in mitigating risks.
By going passwordless, facilitated by solutions like PureAuth, businesses can ensure user credentials and data are secure by default and design, protecting against future incidents.