BreachForums booms on the back of billion-record Chinese data leak

guest · Jul 29, 2022

Plenty of recent users appear to be from China, and hoping for more leaks of local data
July 29, 2022

The popularity of stolen data bazaar BreachForums surged after it was used to sell a giant database of stolen information describing Chinese citizens, threat intelligence firm Cybersixgill said on Thursday.

The number of leaks posted on BreachForums increased – from an average of 14 a month to 52 per month – following the posting of the infamous billion-record Shanghai National Police database in early July, reported Cybersixgill.

"The new Chinese members seem to be interested in a wide variety of what the forum has to offer, including data leaks, streaming accounts, adult content, hacking courses, and cracking tools," wrote Cybersixgill.
Click to expand...

The billion-record database allegedly stolen from the Shanghai National Police was posted for sale for 10 Bitcoin (around $200,000) in early July. The database contained names, addresses, birthplaces, national ID numbers, mobile phone numbers as well as details of crimes or cases related to Chinese citizens.
Although the police have not publicly commented on the leak, the forum has been blocked within China.

Cybersixgill hypothesized the forum's sudden popularity may be due to China-based criminals believing it is a likely source of useful data.
Click to expand...

Cybersixgill: Out of Breach: Shanghai Police Breach Leads to Increased Chinese Underground Activity

On June 30 on a popular underground forum, an actor uploaded a massive amount of data reportedly exfiltrated from the Shanghai National Police (SHGA). This included names, addresses, birthplaces, national IDs, phone numbers and criminal records of 1 billion Chinese citizens—over 70% of China’s total population. The data, 23 TB in total, was advertised for sale for 10 bitcoin ($200,000), and anyone could receive a free sample of 750,000 entries.
Click to expand...

Cybersixgill research has picked up on two interesting trends in the weeks following this breach:

There has been a significant increase in the quantity of Chinese-language activity on this predominantly English-speaking forum.

Subsequently there has been a notable rise in data leaks of Chinese entities shared on the forum.

Click to expand...

guest · Aug 2, 2022

Stolen Data is being sold on BreachForums...
Threat actor claims to have hacked European manufacturer of missiles MBDA
July 31, 2022

MBDA is a European multinational developer and manufacturer of missiles that was the result of the merger of the main French, British and Italian missile systems companies (Aérospatiale–Matra, BAE Systems, and Finmeccanica (now Leonardo). The name MBDA comes from the initialism of the names missile companies: Matra, BAe Dynamics and Alenia.

A threat actor that goes online with the moniker Adrastea, and that defines itself as a group of independent cybersecurity specialists and researchers, claims to have hacked MBDA.
Click to expand...

Adrastea said that they have found critical vulnerabilities in the company infrastructure and have stolen 60 GB of confidential data.

The attackers said that the stolen data includes information about the employees of the company involved in military projects, commercial activities, contract agreements and correspondence with other companies.
Click to expand...

As a proof of the hack Adrastea shared a link to a password-protected linked archive containing internal documents related to projects and correspondence.
At this time it is not clear if the threat actors have breached only one of the national divisions of the company, they did not disclose details about the attack.
Click to expand...

guest · Aug 2, 2022

mood said: ↑

Stolen Data is being sold on BreachForums...
Threat actor claims to have hacked European manufacturer of missiles MBDA
July 31, 2022
Click to expand...

EU missile maker MBDA confirms data theft extortion, denies breach
August 2, 2022

MBDA, one of the largest missile developers and manufacturers in Europe, has responded to rumors about a cyberattack on its infrastructure saying that claims of a breach of its systems are false.

A statement from the company clarifies that it was the target of a criminal group who spread the false news of hacking its information systems in an attempt to blackmail the organization into paying a ransom.
The extortionists had acquired MBDA data from an external drive used by the company's Italian division and demanded a ransom to not leak or sell the files.

“The origin of the data has already been ascertained, having been acquired from an external hard drive. It has been confirmed that no hacking of the company’s secure networks has occurred,” MBDA says.
Click to expand...

The firm doesn’t provide any explanation about how the extortionists got their hands onto the external hard drive from MBDA Italy.
The hacking claims
On July 30, 2022, a hacking group called “Andrastea”, who describe themselves as a group of cybersecurity researchers, posted a claim on a popular hacking forum about breaching MBDA by leveraging critical network vulnerabilities.

Andrastea shared samples of the stolen data as proof that the data they have is real.
Click to expand...

guest · Aug 13, 2022

Hacker offers to sell data of 48.5 million users of Shanghai's COVID app
August 12, 2022

A hacker has claimed to have obtained the personal information of 48.5 million users of a COVID health code mobile app run by the city of Shanghai, the second claim of a breach of the Chinese financial hub's data in just over a month.

The hacker with the username as "XJP" posted an offer to sell the data for $4,000 on the hacker forum Breach Forums on Wednesday.
The hacker provided a sample of the data including the phone numbers, names and Chinese identification numbers and health code status of 47 people.
Click to expand...

"This DB (database) contains everyone who lives in or visited Shanghai since Suishenma's adoption," XJP said in the post, which originally asked for $4,850 before lowering the price later in the day.

The purported Suishenma breach comes after a hacker early last month said they had procured 23 terabytes of personal information belonging to one billion Chinese citizens from the Shanghai police.
That hacker also offered to sell the data on Breach Forums. read more
Click to expand...

guest · Dec 31, 2022

Stolen Data is being sold on BreachForums...
Leading sports betting firm BetMGM discloses data breach
By Sergiu Gatlan @serghei - December 22, 2022

Leading sports betting company BetMGM disclosed a data breach after a threat actor stole personal information belonging to an undisclosed number of customers.
Click to expand...

While the personal info stolen in the attack varies for each customer, the attackers obtained a wide range of data, including names, contact info (like postal addresses, email addresses, and phone numbers), dates of birth, hashed Social Security numbers, account identifiers (like player IDs and screen names) and info related to transactions with BetMGM.

The company added that it discovered the incident on November 2022 but believes the breach occurred in May 2022.

"BetMGM currently has no evidence that patron passwords or account funds were accessed in connection with this issue," a press release issued on Wednesday says.
Click to expand...

Over 1.5 million BetMGM customers allegedly affected
While the betting firm is yet to disclose the number of customers that had their information stolen in the May breach, the likely attackers are already selling it online.

"We breached BetMGM's casino database current as of Nov 2022," says the threat actor named 'betmgmhacked' who put up the stolen information for sale on a hacking forum yesterday.
"The database is inclusive of every BetMGM casino customer (over 1.5M) as of November 2022 from MI, NJ, ON, PV, and WV. Any customer that has placed a casino wager included in this database."
BetMGM's sports betting and online gaming brand portfolio includes BetMGM, Borgata Casino, Party Casino, and Party Poker.
Click to expand...

Log in or Sign up

BreachForums booms on the back of billion-record Chinese data leak

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

BreachForums booms on the back of billion-record Chinese data leak

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches