23,600 hacked databases have leaked from a defunct 'data breach index' site

guest · Nov 4, 2020

23,600 hacked databases have leaked from a defunct 'data breach index' site
Site archive of Cit0day.in has now leaked on two hacking forums after the service shut down in September
November 4, 2020
https://www.zdnet.com/article/23600...leaked-from-a-defunct-data-breach-index-site/

More than 23,000 hacked databases have been made available for download on several hacking forums and Telegram channels in what threat intel analysts are calling the biggest leak of its kind.

The database collection is said to have originated from Cit0Day.in, a private service advertised on hacking forums to other cybercriminals.
Cit0day operated by collecting hacked databases and then providing access to usernames, emails, addresses, and even cleartext passwords to other hackers for a daily or monthly fee.
Click to expand...

The idea behind the site isn't unique, and Cit0Day could be considered a reincarnation of similar "data breach index" services such as LeakedSource and WeLeakInfo, both taken down by authorities in 2018 and 2020, respectively.

However, the Cit0day website went down on September 14, when the site's main domain sported an FBI and DOJ seizure notice.
Rumors started circulating on hacking forums that the site's creator, an individual known as Xrenovi4, might have been arrested, similar to what happened to the authors of LeakedSource and WeLeakInfo.

But all signs pointed to the fact that the FBI takedown notice was fake.
Click to expand...

Cit0day hacked database now shared online
But if users hoped that Cit0day and Xrenovi4 would shut down and then walk into the sunset, this is not what happened.

While it's unclear if Xrenovi4 leaked the data themselves or if the data was hacked by a rival gang, Cit0day's entire collection of hacked databases was provided as a free download on a well-known forum for Russian-speaking hackers last month.
ZDNet was not able to download the entire dataset, estimated at around 50GB and 13 billion user records, but forum users who did confirmed the data's authenticity. Additional confirmation was provided to ZDNet earlier today by Italian security firm D3Lab.
Click to expand...

guest · Dec 2, 2020

Data has been added to Have I Been Pwned:

Cit0day – 226,883,414 breached accounts

Cit0day
In November 2020, a collection of more than 23,000 allegedly breached websites known as Cit0day were made available for download on several hacking forums. The data consisted of 226M unique email address alongside password pairs, often represented as both password hashes and the cracked, plain text versions. Independent verification of the data established it contains many legitimate, previously undisclosed breaches. The data was provided to HIBP by dehashed.com.

Breach date: 4 November 2020
Date added to HIBP: 19 November 2020
Compromised accounts: 226,883,414
Compromised data: Email addresses, Passwords
Permalink
Click to expand...

guest · Dec 9, 2020

New Jersey fax company leaks 560k+ emails and dehashed passwords
December 8, 2020
https://cybernews.com/security/new-jersey-fax-company-leaks-560k-emails-dehashed-passwords/

The New Jersey fax company Fax Express appears to have had more than half a million of their customers’ emails and dehashed, plain text passwords leaked on a popular Russian hacking forum. According to its website, Fax Express has been in business for 40 years, having been in operation since 1980.

This apparent Fax Express database is connected to the domain shredderstoo.com, which seems to be a mirror site of faxexpress.com. The database leak was dehashed from hashed database tables originating from Cit0day.in leaks, in which 23,000 hacked databases were published in early November.
Click to expand...

The now-defunct Cit0day.in was a private service for cybercriminals that collected hacked databases and allowed their customers to access usernames, emails, addresses, and plain text passwords for a subscription fee.
Who had access to the data?
The apparent Fax Express/shredderstoo.com data was freely available on a popular Russian hacking forum. For that reason, it’s reasonable to assume that a sizable portion of the users on the forum had access to the data.
What’s the impact of the leak?
While the apparent Fax Express/shredderstoo.com leak doesn’t contain particularly “sensitive” data, such as credit card, passport or social security numbers, this type of data is still very useful for cybercriminals.
Click to expand...

Log in or Sign up

23,600 hacked databases have leaked from a defunct 'data breach index' site

guest Guest

guest Guest

guest Guest

Log in or Sign up

23,600 hacked databases have leaked from a defunct 'data breach index' site

guest Guest

guest Guest

guest Guest

Useful Searches