Al-Anon member details and chats exposed in data breach

Sensitive information, including full names, encrypted passwords, emails, phone numbers, and private chats of members of Al-Anon, a support group for the friends and families of alcoholics, has been exposed in a recent data breach.

Al-Anon is a global organization that provides support to individuals affected by someone else's alcoholism. Members gather to share their experiences, learn coping strategies, and find happiness, regardless of whether the alcoholic in their life is still drinking. With over 24,000 groups worldwide, Al-Anon plays a critical role in supporting those affected by alcoholism.

On July 26th, the Cybernews research team discovered a dataset with over 200,000 records of Al-Anon.org users. Unfortunately, the MongoDB database was unprotected, meaning that all the sensitive data it was supposed to safeguard, including some private chats, was up for grabs.

What was leaked

Needless to say, privacy for Al-Anon users is of the utmost importance, and we immediately contacted the organization to ensure they mitigated the issue as soon as possible. On July 30th, the database was secured.

However, threat actors can discover unprotected data in mere seconds. While we have no evidence of this happening in the Al-Anon case, we need to point out that sensitive records had been exposed for several days, and the following data could be compromised:

• Full names

• Emails

• Encrypted passwords

• Phone numbers

• Verification tokens

• The date users joined Al-Anon

• Private chats

“The exposure of not just personal data, but also private communications, represents a serious violation of user trust and could lead to emotional distress, identity theft, and other privacy concerns,” Cybernews researchers explained.

While the database was secured promptly after the issue was reported, the organization has not yet provided any additional information or issued a public disclosure, raising concerns over whether users were informed of the breach.

We contacted their media representatives to learn more about this. However, we haven’t yet received a reply.

Broader implications

Exposing individuals who are struggling with the impact of alcoholism is concerning enough, but the potential for identity theft adds another layer of risk.

For example, in a notable case, an American citizen's stolen identity was used by North Korean operatives to secure remote IT jobs in the US, funneling millions of dollars to fund North Korea’s weapons of mass destruction (WMD) program.

Unfortunately, the Al-Anon breach is just one example in a broader trend of unsecured datasets being discovered daily by our research team. Organizations that handle sensitive user data must proactively secure their databases and protect user privacy.

• Secure database: Ensure all databases are secured with strong authentication and encryption methods.

• Data audit: Conduct a comprehensive audit to identify any other potential vulnerabilities and ensure all user data is properly secured.

• User notification: Inform affected users of the breach and provide guidance on securing their accounts and personal information.

• Enhanced encryption: Strengthen encryption methods for stored data and communications to prevent unauthorized access.

• Regular security assessments: Implement regular security audits and assessments to identify and address vulnerabilities before they can be exploited.

• Transparent communication: Provide clear and transparent communication to users regarding the breach and the steps taken to mitigate any potential harm.