Shiny Hunters hackers try to sell a host of user records from breaches

guest · May 8, 2020

Shiny Hunters hackers try to sell a host of user records from breaches
May 8, 2020
https://www.bleepingcomputer.com/ne...to-sell-a-host-of-user-records-from-breaches/

Going by the name Shiny Hunters, the group is now selling user records from meal kit delivery service HomeChef, from photo print service ChatBooks, and Chronicle.com, a news source for higher education.
Millions of user records for sale
Together, the three databases count user records and passwords from 26 million accounts. The ask prices are between $1,500 and $2,500.
In a conversation with BleepingComputer, the hackers said that they have more databases from other breached websites. They plan on selling them in the near future.

With eight million user records, the HomeChef trove is the most expensive. It was advertised today and had not been sold when the researchers saw the hackers’ post.
The hackers demand $2,500 for emails, bcrypt-hashed passwords, IP addresses. Although the passwords need to be dehashed to extend the range of illegal activities this database can serve, it still has value.
Click to expand...

The post for the ChatBooks database was published on May 3 and the asking price is $2,500 for 15 million rows of data. It did not have any buyers through the dark web forum it was advertised on.
From the sample provided by Shiny Hunters, the database has email addresses, passwords hashed with the SHA-512 function, social media access tokens, and some PII.

With a price tag of $1,500, the data from Chronicle.com is the cheapest. It is also the smallest, with three million user records.
It was posted on May 3 and there are no details about the type of information it contains. Just like with the others, nobody bought it.
Click to expand...

The lack of buyers makes it probable that the three databases will soon become available on other markets for lower prices.

“It is likely that this actor will continue to breach companies and post their content for sale,” notes ZeroFox Alpha Team in a blog post on Thursday. They add that these tactics proved successful for other hackers and there is no reason this should not work in the case of Shiny Hunters.
Click to expand...

ZeroFox: Tokopedia and Microsoft Breach Broker selling fresh trove of 26 million accounts

ShinyHunters is taking a page out of the book of gnosticplayers, the breach data broker who in 2018-2019 pilfered billions of records from dozens of companies and sold them online. Due to the verification of the Tokopedia breach by multiple researchers and the company itself, ZeroFOX Alpha Team has HIGH confidence that these new breaches are legitimate, and will most likely be available on other breach marketplaces at lower prices in the near future.
Click to expand...

Minimalist · May 10, 2020

ChatBooks discloses data breach after data sold on dark web

ChatBooks photo print service has informed its customers that user information was stolen from their systems following a cyber attack. Data consisting of 15 million user records is now being offered for sale on the dark web.
Click to expand...

https://www.bleepingcomputer.com/ne...oses-data-breach-after-data-sold-on-dark-web/

guest · May 10, 2020

A hacker group is selling more than 73 million user records on the dark web
Hacker group "ShinyHunters" is selling the data of 10 companies
May 9, 2020
https://www.zdnet.com/article/a-hac...than-73-million-user-records-on-the-dark-web/

A hacker group going by the name of ShinyHunters claims to have breached ten companies and is currently selling their respective user databases on a dark web marketplace for illegal products.

Encouraged and emboldened by the profits from the Tokopedia sale, the same group has, over the course of the current week, listed the databases of 10 more companies.
This includes user databases allegedly stolen from organizations such as:

Online dating app Zoosk (30 million user records)

Printing service Chatbooks (15 million user records)

South Korean fashion platform SocialShare (6 million user records)

Click to expand...

Food delivery service Home Chef (8 million user records)

Online marketplace Minted (5 million user records)

Online newspaper Chronicle of Higher Education (3 million user records)

South Korean furniture magazine GGuMim (2 million user records)

Health magazine Mindful (2 million user records)

Indonesia online store Bhinneka (1.2 million user records)

US newspaper StarTribune (1 million user records)

Click to expand...

guest · May 13, 2020

Star Tribune Warns Subscribers Of Possible Security Breach
May 12, 2020
https://minnesota.cbslocal.com/2020...arns-subscribers-of-possible-security-breach/

On Monday, Star Tribune subscribers were notified of a possible security breach in its website log-in database.

The paper says it only stored usernames and passwords there.
Customers’ financial information was not stored there, the paper said.

Out of caution, the Star Tribune emailed subscribers advising them to change their passwords and not reply to any emails asking for your personal information.
Click to expand...

Star Tribune: Hacker group claims to have stolen Star Tribune user information

guest · May 20, 2020

Home Chef announces data breach after hacker sells 8M user records
May 20, 2020
https://www.bleepingcomputer.com/ne...ta-breach-after-hacker-sells-8m-user-records/

Home Chef, a US-based meal kit and food delivery service, announced a data breach today after a hacker sold 8 million user records on a dark web marketplace.

Last week, BleepingComputer reported that a hacking group actor named Shiny Hunters was selling the user records for eleven companies on a dark web marketplace. The threat actor was selling these databases for $500 to $2,500.
The user records for Home Chef was one of the databases being sold and allegedly contained 8 million user records.
Home Chef issues data breach notification
Now, almost two weeks later, Home Chef has officially disclosed the data breach in a "Data security incident" notice posted to their web site.

"Protection of customer data is a top priority for Home Chef, and we work hard to safeguard our customers’ information. We recently learned of a data security incident impacting select customer information," their data security incident FAQ states.
Click to expand...

guest · May 21, 2020

ShinyHunters Is a Hacking Group on a Data Breach Spree
May 21, 2020
https://www.wired.com/story/shinyhunters-hacking-group-data-breach-spree/

Over the first two weeks of May, a hacking group called ShinyHunters has been on a rampage, hawking what it claims is close to 200 million stolen records from at least 13 companies.
Such binges aren't unprecedented in the dark web stolen data economy, but they're a crucial driver of identity theft and fraud.

"What’s interesting about this is how this group appeared out of nowhere and had all this new data for sale," says Vinny Troia, CEO of the IT security firm Night Lion Security who has been tracking ShinyHunters. "I always find that as an immediate flag. Nobody just drops into the scene with all this stuff. So that's why I don't believe Shiny is a new player to this market."

After generating buzz from these early disclosures, ShinyHunters went on a tear over the following week, stating that it had data from 10 more sites, including dating app Zoosk, meal kit company Home Chef, [...] Not all of the companies have acknowledged ShinyHunters' claims, but more and more have gone public over the last two weeks with confirmations.
Click to expand...

An entity claiming to be a member of ShinyHunters said in an instant message conversation with WIRED that it is "not too hard" to breach so many organizations. "It's just a way to make money, but if companies are afraid and want their database taken off the market, they can contact me for an agreement, it has been done recently and both sides were satisfied," the group said.

And whether it's ShinyHunters or another actor doing the dumping, there always seems to be someone who's motivated to steal data for the selling.
Click to expand...

guest · May 22, 2020

Mathway investigates data breach after 25M records sold on dark web
May 22, 2020
https://www.bleepingcomputer.com/ne...ta-breach-after-25m-records-sold-on-dark-web/

A data breach broker is selling a database that allegedly contains 25 million Mathway user records on a dark web marketplace.

The Mathway app is top-rated, with over 10 million installs on Android and ranked as #4 under education in the Apple Store.
This week, a data breach seller known as Shiny Hunters began to publicly sell an alleged Mathway database on a dark web marketplace for $4,000.

In a sample of the database shared with BleepingComputer, the most concerning of the exposed data are the email addresses and hashed passwords. Otherwise, the data is mostly what appears to be system data.
Click to expand...

Mathway told BleepingComputer that they are currently investigating the reports of a data breach.

"We are aware of reports of a potential data compromise. We are working with cybersecurity experts to investigate further, and will take the appropriate steps to ensure the security of customer information." Mathway said in a statement to BleepingComputer.
In a second email, Mathway told BleepingComputer that they should have more information soon.
Click to expand...

guest · May 28, 2020

Minted discloses data breach after 5M user records sold online
May 28, 2020
https://www.bleepingcomputer.com/ne...ata-breach-after-5m-user-records-sold-online/

Minted, a US-based marketplace for independent artists, has disclosed a data breach after a hacker sold a database containing 5 million user records on a dark web marketplace.

Earlier this month, BleepingComputer reported that a hacking group named Shiny Hunters was selling the user records for eleven companies on a dark web marketplace.
One of these databases allegedly contained 5 million users and mailing address records for Minted. This database was being sold for $2,500.

At the time of our reporting, BleepingComputer emailed Minted but never received a response.
Since our original reporting of these databases, Chatbook and Home Chef have also issued data breach notifications.
Click to expand...

Minted issues data breach notification
Now, almost three weeks later, Minted has started to notify users that they were affected by a data breach after their systems were hacked.
According to Minted's data breach notification, the attackers gained access to the company's user database on May 6th, 2020.

"The information involved includes customers’ names and login credentials to their Minted accounts, consisting of their email address and password. The passwords were hashed and salted and not in plain text. Telephone number, billing address, shipping address(es), and, for fewer than one percent of affected customers, date of birth, also may have been impacted," Minted states in their data breach notification.
Click to expand...

Minted Notifies Users Of Data Security Incident

guest · Jun 6, 2020

mood said: ↑

Mathway investigates data breach after 25M records sold on dark web
May 22, 2020
https://www.bleepingcomputer.com/ne...ta-breach-after-25m-records-sold-on-dark-web/
Click to expand...

Data has been added to Have I Been Pwned:

Mathway – 25,692,862 breached accounts

Mathway
In January 2020, the math solving website Mathway suffered a data breach that exposed over 25M records. The data was subsequently sold on a dark web marketplace and included names, Google and Facebook IDs, email addresses and salted password hashes.

Breach date: 13 January 2020
Date added to HIBP: 5 June 2020
Compromised accounts: 25,692,862
Compromised data: Device information, Email addresses, Names, Passwords, Social media profiles
Permalink
Click to expand...

guest · Jun 13, 2020

Online marketplace Minted hit with California privacy lawsuit after data breach
June 13, 2020
https://www.reuters.com/article/dat...ivacy-lawsuit-after-data-breach-idUSL1N2DP2E4

Online design marketplace Minted Inc. has been hit with a lawsuit under California’s new privacy law accusing it of failing to implement reasonable security measures to protect personal information.

The proposed class action lawsuit, filed in San Francisco federal court on Thursday, comes after the company revealed last month that unauthorized actors accessed customers’ names and account login information. The plaintiffs, seeking to represent classes of individuals whose personal information was compromised in the breach, sued under the California Consumer Privacy Act, which took effect in January.
Click to expand...

guest · Jul 18, 2020

Database of Indonesian store Bhinneka dumped with 1 million+ accounts
July 15, 2020
https://www.hackread.com/indonesia-bhinneka-database-dumped-1-million-accounts/

Sometimes though due to reasons such as revenge or perhaps ol’ fashioned fun, attackers dump the databases online making them freely available.
A case of the latter has emerged today when a hacker posted the database of one of Indonesia’s largest online store named Bhinneka on a hacker forum.

The database was initially hacked on 27 January earlier this year but has now been put out in the open by the attacker. The downloadable folder contains 2 SQL files which contain the records of approximately 1,262,300 accounts in totality.
Hackread.com can confirm that the same Tokopedia hackers are behind the Bhinneka breach.
Click to expand...

guest · Jul 25, 2020

Tech unicorn Dave admits to security breach impacting 7.5 million users
Dave user data is now available for download on a public hacking forum
July 26, 2020
https://www.zdnet.com/article/tech-...-security-breach-impacting-7-5-million-users/

Digital banking app and tech unicorn Dave.com confirmed today a security breach after a hacker published the details of 7,516,625 users on a public forum.

In an email to ZDNet today, Dave said the security breach originated on the network of a former business partner, Waydev, an analytics platform used by engineering teams.

"As the result of a breach at Waydev, one of Dave's former third party service providers, a malicious party recently gained unauthorized access to certain user data at Dave," a spokesperson told ZDNet.
The company also brought in cyber-security firm CrowdStrike to assist the investigation.
Click to expand...

DAVE USER DATA PUBLISHED ON HACKER FORUM
ZDNet learned of the security breach on early Saturday morning, on July 25. A reader tipped ZDNet that a hacker was offering the Dave app's user data on RAID, a hacking forum that has built a reputation for being the go-to place for hackers to leak databases.

The hacker has a reputation as well. Going by the name of ShinyHunters, this is the same person/group who also breached and leaked/sold data from many other companies, including Mathway, Tokopedia, Wishbone, and many more.
Click to expand...

Passwords were also included but were hashed using bcrypt, a hashing function that prevents hackers from viewing the passwords in cleartext.
Dave said that currently, they had no evidence to suggest that hackers used the data to gain access to user accounts and execute any unauthorized actions.
Click to expand...

guest · Jul 27, 2020

mood said: ↑

Tech unicorn Dave admits to security breach impacting 7.5 million users July 26, 2020
In an email to ZDNet today, Dave said the security breach originated on the network of a former business partner, Waydev, an analytics platform used by engineering teams. [...]
Click to expand...

Hackers stole GitHub and GitLab OAuth tokens from Git analytics firm Waydev
OAuth tokens have been abused for intrusions at least two other companies, Dave.com and Flood.io
July 27, 2020
https://www.zdnet.com/article/hacke...-oauth-tokens-from-git-analytics-firm-waydev/

Waydev, an analytics platform used by software companies, has disclosed a security breach earlier this month.
The company says that hackers broke into its platform and stole GitHub and GitLab OAuth tokens from its internal database.

Waydev CEO and co-founder Alex Circei told ZDNet today in a phone call that hackers used a blind SQL injection vulnerability to gain access to its database, from where they stole GitHub and GitLab OAuth tokens.
The hackers then used some of these tokens to pivot to other companies' codebases and gain access to their source code projects.
Click to expand...

At the time of writing, two companies have reported security breaches this month and blamed the incident on Waydev -- loan app Dave.com and software testing service Flood.io.

"Due to GitHub's privacy policy, they will inform the affected users personally," Waydev said. "If you were affected by the attackers please contact us at security@waydev.co in order to connect you with the authorities."
The indicators of compromise, along with instructions for Waydev customers on how to search their logs for the hacker's presence, are available in this Waydev support page.
Click to expand...

guest · Jul 28, 2020

Hacker leaks 386 million user records from 18 companies for free
July 28, 2020
https://www.bleepingcomputer.com/ne...lion-user-records-from-18-companies-for-free/

A threat actor is flooding a hacker forum with databases exposing expose over 386 million user records that they claim were stolen from eighteen companies during data breaches.
Since July 21st, a seller of data breaches known as ShinyHunters has begun leaking the databases for free on a hacker forum known for selling and sharing stolen data.

ShinyHunters has been involved in or responsible for a wide assortment of data breaches this past year, including Wattpad, Dave, Chatbooks, Promo.com, Mathway, HomeChef, and the breach of Microsoft private GitHub repository.
Click to expand...

Of the databases released since July 21st, nine of them were already disclosed in some manner in the past.

The other nine, including Havenly, Indaba Music, Ivoy, Proctoru, Rewards1, Scentbird, and Vakinha, have not been previously disclosed.
The full list of the 18 data breaches are listed below: [...]
When BleepingComputer asked ShinyHunters why they dumped all of these databases, we were told that they were leaked for everyone's benefit.

"I just thought: 'I've made enough money now' so I leaked for everyone's benefit."
Click to expand...

guest · Jul 28, 2020

Alcohol delivery service Drizly confirms data breach
July 28, 2020
https://techcrunch.com/2020/07/28/drizly-data-breach/

Online alcohol delivery startup Drizly has told customers that it was hit by a data breach.

In an email to customers obtained by TechCrunch, the company said that a hacker “obtained” some customer data. The hacker took customer email addresses, date-of-birth, passwords hashed using the stronger bcrypt algorithm, and in some cases delivery address, the email read.
As many as 2.5 million Drizly accounts are believed to have been stolen.

The listing, which we are not linking to, claims to have “fresh hacked” [sic] Drizly accounts. The data is on sale for $14, at the time of writing .
Click to expand...

guest · Jul 29, 2020

mood said: ↑

Alcohol delivery service Drizly confirms data breach July 28, 2020
Click to expand...

Data has been added to Have I Been Pwned:

Drizly – 2,479,044 breached accounts

Drizly
In approximately July 2020, the US-based online alcohol delivery service Drizly suffered a data breach. The data was sold online before being extensively redistributed and contained 2.5 million unique email addresses alongside names, physical and IP addresses, phone numbers, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

Breach date: 2 July 2020
Date added to HIBP: 28 July 2020
Compromised accounts: 2,479,044
Compromised data: Dates of birth, Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
Permalink
Click to expand...

guest · Jul 30, 2020

Data has been added to Have I Been Pwned:

Appen – 5,888,405 breached accounts

Appen
In June 2020, the AI training data company Appen suffered a data breach exposing the details of almost 5.9 million users which were subsequently sold online. Included in the breach were names, email addresses and passwords stored as bcrypt hashes. Some records also contained phone numbers, employers and IP addresses. The data was provided to HIBP by dehashed.com.

Breach date: 22 June 2020
Date added to HIBP: 30 July 2020
Compromised accounts: 5,888,405
Compromised data: Email addresses, Employers, IP addresses, Names, Passwords, Phone numbers
Permalink
Click to expand...

Chatbooks – 2,520,441 breached accounts

Chatbooks
In March 2020, the photo print service Chatbooks suffered a data breach which was subsequently put up for sale on a dark web marketplace. The breach contained 15 million user records with 2.5 million unique email addresses alongside names, phone numbers, social media profiles and salted SHA-512 password hashes. The data was provided to HIBP by dehashed.com.

Breach date: 26 March 2020
Date added to HIBP: 29 July 2020
Compromised accounts: 2,520,441
Compromised data: Email addresses, Names, Passwords, Phone numbers, Social media profiles
Permalink
Click to expand...

Scentbird – 5,814,988 breached accounts

Scentbird
In June 2020, the online fragrance service Scentbird suffered a data breach that exposed the personal information of over 5.8 million customers. Personal information including names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes and indicators of password strength were all exposed. The data was provided to HIBP by breachbase.pw.

Breach date: 22 June 2020
Date added to HIBP: 30 July 2020
Compromised accounts: 5,814,988
Compromised data: Dates of birth, Email addresses, Genders, Names, Password strengths, Passwords
Permalink[
Click to expand...

guest · Jul 30, 2020

Startups disclose data breaches after massive 386M records leak
July 30, 2020
https://www.bleepingcomputer.com/ne...ata-breaches-after-massive-386m-records-leak/

Startups have begun to disclose data breaches after a massive leak of stolen databases was published on a hacker forum this month.

This week, BleepingComputer was the first to report that ShinyHunters, a threat actor known for data breaches, began to leak the stolen databases of eighteen web sites for free on a hacker forum.
Most of the companies targeted by these attacks appear to be startups, with the full list of the 18 data breaches and their updated disclosure status are listed below: [...]
Drizly discloses data breach
On July 27th, BleepingComputer contacted alcohol delivery startup Drizly regarding a database containing approximately 2.5 million records leaked for free on a hacker forum.
Scentbird disclosed data breach soon after
BleepingComputer also contacted fragrance subscription service Scentbird after their database was leaked for free by ShinyHunters.
Click to expand...

guest · Aug 2, 2020

Data has been added to Have I Been Pwned:

Swvl – 4,195,918 breached accounts

Swvl
In June 2020, the Egyptian bus operator Swvl suffered a data breach which impacted over 4 million members of the service. The exposed data included names, email addresses, phone numbers, profile photos, partial credit card data (type and last 4 digits) and passwords stored as bcrypt hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by breachbase.pw.

Breach date: 23 June 2020
Date added to HIBP: 31 July 2020
Compromised accounts: 4,195,918
Compromised data: Email addresses, Names, Partial credit card data, Passwords, Phone numbers, Profile photos
Permalink
Click to expand...

Havenly – 1,369,180 breached accounts

Havenly
In June 2020, the interior design website Havenly suffered a data breach which impacted almost 1.4 million members of the service. The exposed data included email addresses, names, phone numbers, geographic locations and passwords stored as SHA-1 hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by dehashed.com.

Breach date: 25 June 2020
Date added to HIBP: 1 August 2020
Compromised accounts: 1,369,180
Compromised data: Email addresses, Geographic locations, Names, Passwords, Phone numbers
Permalink
Click to expand...

Vakinha – 4,775,203 breached accounts

Vakinha
In June 2020, the Brazilian fund raising service Vakinha suffered a data breach which impacted almost 4.8 million members. The exposed data included email addresses, names, phone numbers, geographic locations and passwords stored as bcrypt hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by dehashed.com.

Breach date: 22 June 2020
Date added to HIBP: 1 August 2020
Compromised accounts: 4,775,203
Compromised data: Dates of birth, Email addresses, IP addresses, Names, Passwords, Phone numbers
Permalink
Click to expand...

집꾸미기 – 1,298,651 breached accounts

집꾸미기
In March 2020, the Korean interior decoration website ???? (Decorating the House) suffered a data breach which impacted almost 1.3 million members. Served via the URL ggumim.co.kr, the exposed data included email addresses, names, usernames and phone numbers, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by breachbase.pw.

Breach date: 27 March 2020
Date added to HIBP: 2 August 2020
Compromised accounts: 1,298,651
Compromised data: Email addresses, Names, Phone numbers, Usernames
Permalink
Click to expand...

guest · Aug 2, 2020

Havenly discloses data breach after 1.3M accounts leaked online
August 2, 2020
https://www.bleepingcomputer.com/ne...data-breach-after-13m-accounts-leaked-online/

Havenly, a US-based interior design web site, has disclosed a data breach after a hacker posted a database containing 1.3 million user records for free on a hacker forum.

On July 27th, BleepingComputer contacted Havenly to report the data breach but had not received a reply to our inquiry.
Yesterday, five days after we sent our email, Havenly officially disclosed the data breach and are emailing notifications to users.
Havenly issues data breach notification
Havenly is sending out data breach notifications stating that they "recently became aware of a potential incident" and performed a mandatory reset of all passwords.

"We take the security of our community very seriously. As a precaution, we wanted to let you know that we recently became aware of a potential incident that may have affected the security of certain customer accounts. We are working with external security experts to investigate this matter."
Click to expand...

guest · Aug 6, 2020

Delivery startup, iVoy, experiences data breach, over 127,000 accounts exposed
August 3, 2020
https://www.contxto.com/en/mexico/logistics-startup-ivoy-data-breach/

What a week it must have been over at Mexican logistics startup, iVoy. When your users’ data has been potentially compromised, you have a lot to do.

Last Tuesday (28), news broke that it was among a series of companies to experience a data breach. In the process, a reported 127,432 account users’ emails and iVoy passwords were exposed on an online forum.
The startup stated that it’s deployed all its security protocols and that “users’ personal data is safe.” But just in case, it advised them to change their passwords.
Click to expand...

guest · Aug 6, 2020

Hackers publish Australian universities’ ProctorU data
The leaked records include usernames, unencrypted passwords, legal names and full residential addresses
August 5, 2020
http://honisoit.com/2020/08/hackers-publish-australian-universities-proctoru-data/

Hackers have published a database of 440,000 ProctorU user records, including records belonging to University of Sydney staff.

The database is part of 386 million user records published by hacker group ShinyHunters over the past week, cyber-security publication BleepingComputer reports. The data includes usernames, unencrypted passwords, legal names and full residential addresses.
Click to expand...

Honi Soit can exclusively report that it includes user records with emails belonging to the University of Sydney, the University of New South Wales, the University of Melbourne, the University of Queensland, the University of Tasmania, James Cook University, Swinburne University of Technology, the University of Western Australia, Curtin University and the University of Adelaide.
It does not appear that any records of USyd students are included in the database.
Click to expand...

guest · Aug 7, 2020

Zoosk (2020) – 23,927,853 breached accounts

Zoosk (2020)
In January 2020, the online dating service Zoosk suffered a data breach which was subsequently shared extensively across online hacking communities. The breach contained 24 million unique email addresses alongside extensive personal information including genders, sexualities, dates of birth, physical attributes such as height and weight, religions, ethnicities and political views. The breach also allegedly exposed MD5 password hashes, although the data circulating in hacking circles had this field nulled out. The breach was provided to HIBP by breachbase.pw.
Breach date: 12 January 2020
Date added to HIBP: 7 August 2020
Compromised accounts: 23,927,853
Compromised data: Dates of birth, Drinking habits, Education levels, Email addresses, Ethnicities, Family structure, Genders, Geographic locations, Income levels, Names, Nicknames, Physical attributes, Political views, Relationship statuses, Religions, Sexual orientations, Smoking habits
Click to expand...

mood said: ↑

Hackers publish Australian universities’ ProctorU data August 5, 2020
Click to expand...

Data has been added to Have I Been Pwned:

ProctorU – 444,453 breached accounts

ProctorU
In June 2020, the online exam service ProctorU suffered a data breach which was subsequently shared extensively across online hacking communities. The breach contained 444k user records including names, email and physical addresses, phones numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by breachbase.pw.

Breach date: 26 June 2020
Date added to HIBP: 6 August 2020
Compromised accounts: 444,453
Compromised data: Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
Permalink
Click to expand...

guest · Aug 9, 2020

mood said: ↑

Data has been added to Have I Been Pwned:

ProctorU – 444,453 breached accounts
Click to expand...

ProctorU confirms data breach after data leaked online
August 9, 2020
https://www.bleepingcomputer.com/ne...onfirms-data-breach-after-data-leaked-online/

Online exam proctoring solution ProctorU has confirmed a data breach after a threat actor released a stolen database of user records on a hacker forum.
ProctorU is a proctoring service used by companies and colleges to monitor online tests for cheating.
ProctorU database leaked on a hacker forum
Last month, BleepingComputer broke the story that a known data breach seller had leaked 18 company's databases for free on a hacker forum.

In a tweeted reply to the University of Sydney student newspaper Honi Soit, who further investigated our report, ProctorU confirmed that they suffered a data breach for records from 2014 and are investigating the incident.
Click to expand...

In our analysis of the database, though, users are shown who created ProctorU accounts in other years, including 2012, 2013, 2014, 2015, and even 2017.
BleepingComputer has reached out once again to ProctorU for more information but has not heard back.
Click to expand...

guest · Aug 18, 2020

Lessons learned from the ProctorU breach: Be transparent and timely
August 18, 2020
https://blog.avast.com/proctoru-breach-learnings-avast

The data leak was part of a larger breach that Bleeping Computer wrote about earlier in July that involved more than 380 million records collected from 18 different corporate sources.

ProctorU representatives didn’t immediately respond to requests from the Bleeping Computer writers. It took several weeks and another investigation by student reporters at the University of Sydney Australia student newspaper Honi Soit before the company admitted the breach in this brief notice on the company’s website.
Click to expand...

Delays of weeks aren’t the longest reported in the current crop of breaches, but what the ProctorU situation shows is a lack of cooperation with security researchers and a lack of transparency with business journalists. This harms their corporate brand and erodes their customers’ trust in their business.

This is especially relevant for software such as what ProctorU offers, because hackers can take advantage of remote control tools or design malware to mimic their actions.
Click to expand...

Log in or Sign up

Shiny Hunters hackers try to sell a host of user records from breaches

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Shiny Hunters hackers try to sell a host of user records from breaches

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches