Hacker is selling 34 million user records stolen from 17 companies

guest · Oct 31, 2020

Hacker is selling 34 million user records stolen from 17 companies
October 31, 2020
https://www.bleepingcomputer.com/ne...illion-user-records-stolen-from-17-companies/

A threat actor is selling account databases containing an aggregate total of 34 million user records that they claim were stolen from seventeen companies during data breaches.

On October 28th, a data breach broker created a new topic on a hacker forum to sell the stolen user databases for seventeen companies.
In a conversation with BleepingComputer, the seller told us that they were not responsible for hacking into the seventeen companies and is acting as a broker for the databases.
Click to expand...

Companies allegedly breached in 2020
According to the data breach broke, all of the seventeen databases being sold were obtained in 2020, with the largest breach being Geekie.com.br with 8.1 million records. The most well-known affected company is Singapore's RedMart that exposed 1.1 million rec
The seller told BleepingComputer that they are selling the RedMart database for $1,500.

From the samples of each database seen by BleepingComputer, we have confirmed that exposed email addresses correspond to accounts for thirteen of the allegedly seventeen breached services. We could not verify accounts for Clip.mx, Katapult, CouponTools, or Aps-builder.com.
Click to expand...

The combined databases expose over 34 million user records. While a password is not included in every record, for example, Clip.mx, there is still useful information disclosed in each database that threat actors can use.
Click to expand...

Company

User Records / Disclosed?
Geekie.com.br

8.1 million / No
Clip.mx

4.7 million / No
Wongnai.com

4.3 million / Yes via email
Cermati.com

2.9 million / No
Everything5pounds.com

2.9 million / No
Eatigo.com

2.8 million / No
Katapult.com

2.2 million / No
Wedmegood.com

1.3 million / No
RedMart

1.1 million / Yes
Coupontools.com

1 million / No
W3layouts.com

789 thousand / No
Game24h.vn

779 thousand / No
Invideo.io

571 thousand / No
Apps-builder.com

386 thousand / No
Fantasycruncher.com

227 thousand / No
Athletico.com.br

162 thousand / No
Toddycafe.com

129 thousand / No

guest · Nov 5, 2020

Data has been added to Have I Been Pwned:

Wongnai accounts – 3,924,454 breached accounts

Wongnai
In October 2020, 17 previously undisclosed data breaches appeared for sale including the Thai restaurant, hotel and attraction finding service, Wongnai. The breach exposed almost 4M unique customer records from some time during 2020 along with names, phone numbers, links to social media profiles and passwords stored as MD5 hashes. The data was self-submitted to HIBP by Wongnai.

Breach date: 28 October 2020
Date added to HIBP: 4 November 2020
Compromised accounts: 3,924,454
Compromised data: Dates of birth, Email addresses, Geographic locations, IP addresses, Names, Passwords, Phone numbers, Social media profiles
Permalink
Click to expand...

guest · Nov 15, 2020

Fintech Cermati data breach points to urgency for data protection law: Experts
November 5, 2020
https://www.thejakartapost.com/news...-urgency-for-data-protection-law-experts.html

A recent data breach case involving fintech aggregator platform Cermati.com, the fifth known this year, again highlights the vulnerability of user data on digital platforms and the urgency of a personal data protection bill, experts have said.

Data on almost 3 million users from fintech aggregator platform Cermati.com was leaked and sold online for US$2,200 on Oct. 28, as reported by cybersecurity researcher and consultant Teguh Aprianto via his Twitter account @secgron on Sunday.

“The string of attack that we are seeing is a sign of how important the personal data protection law is,” he said in a statement on Tuesday.
The House of Representatives is planning to conclude deliberations on the personal data protection bill in November, a delay from its initial target of October.
Click to expand...

Cermati.com is the second fintech platform to experience a data breach this year after around 890,000 Kreditplus users' data was leaked in August. Three Indonesian e-commerce platforms, namely Bhinneka.com, Bukalapak and Tokopedia, also reportedly experienced data breaches that stole their customers' details in May, which were then sold on the dark web.

Pratama said the data protection law can oblige digital companies to implement cybersecurity standards, as well as setting a clear regulation on companies’ obligations when a data breach occurs.

“Without such a regulation, when customers become the victim of a data breach, they can only trust the platform to fix the issue. This is where the government must step in to pass the personal data protection bill,” he said.
Click to expand...

Log in or Sign up

Hacker is selling 34 million user records stolen from 17 companies

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hacker is selling 34 million user records stolen from 17 companies

guest Guest

guest Guest

guest Guest

Useful Searches