5 billion records exposed in open ‘data breach database’

guest · Mar 19, 2020

Five billion records exposed in open ‘data breach database’
March 19, 2020
https://www.scmagazine.com/home/sec...records-exposed-in-open-data-breach-database/

More than five billion records were exposed after an Elasticsearch “data breach database” managed by a U.K.-based security firm and housing a trove of security incidents from the last seven years was left unprotected.

“Data was very well structured,” wrote security researcher Bob Diachenko, who discovered the Elasticsearch instance, of the information, which included hashtypes, leak dates, passwords, email addresses, email domains and leak sources.

Diachenko said he was able to confirm some of the “prominent” leaks in the database, such as Adobe, Last.fm, Twitter, LinkedIn, Tumbler and VK.

Calling the leak potentially “one of the biggest to date – five billion records were exposed,” Anurag Kahol, CTO at Bitglass, pointed out that hackers, like security researchers, also “use tools designed to detect abusable misconfigurations within IT assets like ElasticSearch databases.” Bad actors seeking to appropriate data could have easily exploited the vulnerability, he said.

“The sensitive information exposed from [the UK. company’s] Elasticsearch database is more than enough fodder for hackers to launch targeted phishing attacks, engage in account takeover fraud, or even make a profit by selling the data on the dark web,” said Chris DeRamus, CTO at DivvyCloud.
Click to expand...

Security Discovery: A UK-based Security Company Seemed To Have Inadvertently Exposed Its ‘Leaks Database’ with 5B+ Records

guest · Jun 9, 2020

After threatening me with legal action, Keepnet Labs finally issues statement over data breach
████ me, could they have taken any longer?
June 9, 2020
https://www.grahamcluley.com/keepnet-labs-statement-data-breach/

UK security company Keepnet Labs has publicly confirmed that a database it had collated containing more than five billion records from past data breaches was “briefly exposed” on the internet.
If you think you’ve heard about this before, you’re right.

I first reported on the security breach back in March, following the initial discovery of the exposed data – which could be accessed without a password or any authentication – by security researcher Bob Diachenko.
Click to expand...

Honesty, after all, is the best policy – and by apologising and behaving openly you can actually build trust inside this crazy industry of ours.
But Keepnet Labs didn’t do that. Instead, it contacted media outlets requesting that their name be removed from the news reports.

It even contacted people who had simply been quoted in the news reports (individuals who didn’t even name Keepnet Labs in the quote they offered journalists) and threatened them with legal action unless they somehow withdrew their comment.

Crazy stuff.
Click to expand...

Taking so long to make a statement and trying to get your name removed from news articles isn’t a good look. Especially for a security firm.
Click to expand...

Log in or Sign up

5 billion records exposed in open ‘data breach database’

guest Guest

guest Guest

Log in or Sign up

5 billion records exposed in open ‘data breach database’

guest Guest

guest Guest

Useful Searches