Truecaller is used to identifying unknown callers and also provide options to red-flags spammers. The app was developed by True Software Scandinavia AB, a private company in Stockholm, Sweden.
Recently it was observed by Cyble’s researcher that unprotected Amazon S3 buckets contain data from major websites.
Truecaller Data Breach
Today it was identified that an anonymous individual selling 47.5 Million users personal data associated with caller ID app Truecaller on the dark web.
Cyble noted that data contains information categorized as a state, cities, telecom carriers, and personal data.
A dark web ad published states that 47.5 Million Indians Truecaller records are up for sales and it costs only $1000. The data found to be from 2019.
“We were also taken off by surprise with such a low price point (in our opinion)”, reads Cyble blog post.
Researchers able to validate the data, “As part of our preliminary analysis, we noticed that the information was quite well organized such by state, cities, and carrier.”
The threat actor has organized the data in the following way
The data has “over 47.5 million records, and it includes interesting information such as Phone Number, Carrier, Name, Gender, City, Email, Facebook ID, and others.”
If you are a Truecaller you might have a thing to worry about as the personal information has been exposed. Threat actors may use personal details to launch sophisticated attacks targeting individuals.
“It’s easy for bad actors to compile multiple phone number databases and put a Truecaller stamp on it. By doing that, it lends some credibility to the data and makes it easier for them to sell. We urge the public and users not to fall prey to such bad actors whose primary motive is to swindle the people of their money,” said Truecaller spokesperson said.
In 2019, TrueCaller fixed a Flaw Let Hackers Access User Data, System and Location Information.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
