Thursday, March 28, 2024

db8151dd – A Massive Unattributable Data Breach Leaked Tens of Millions of Records

Recently, a massive unattributable private data breach, codenamed as “db8151dd”, has exposed the data records of more than 22 million people, including the addresses, phone numbers, username, password, social media links.

At the moment, the source of this data still remains a mystery, and in this breach, 90 GB of personal information stolen.

According to the reports, a 9to5Mac analyst has received an email from “haveibeenpwned.com,” saying that “his personal data had been violated and it includes email addresses, job titles, phone numbers, addresses, and social media profile links.”

The Australian security expert, Troy Hunt who is the founder and manager of the “Have I Been Pwned” security blog, has stated on his blog, Troy Hunt, “despite my own experience on this subject and capabilities, my own information was stolen and made available in this file.

Even some of my particularly confidential information has also been made public, including the telephone number, that I have always been careful to protect to keep it as confidential as possible.”

Here’s what Troy Hunt stated, “Back in Feb, Dehashed reached out to me with a massive trove of data that had been left exposed on a major cloud provider via a publicly accessible Elasticsearch instance. It contained 103,150,616 rows in total,” while the first 30 of which look like this:-

“The global unique identifier beginning with “db8151dd” features heavily on these first lines hence the name I’ve given the breach. And I’ve had to give it this name because frankly, I’ve absolutely no idea where it came from, nor does anyone else I’ve worked on with this,” said the security expert, Troy Hunt.

Along with this data, the Australian security expert, Troy Hunt, has also found the data of the users with whom he interacted with in the past. He also identified the information relating to some appointments or reminders relating to future commitments, as if this information came directly from personal agendas.

The research on the origin of the file ends in nothing, as Troy Hunt assumes that a lot of this information comes directly from a CRM. As he clarified that even after confronting all his known colleagues and journalists, he has not been able to trace it back with certainty.

Moreover, the security researcher, Troy Hunt has uploaded over 20 million email addresses found in that file to HaveIBeenPwned, simply to ensure that you have not suffered the theft of sensitive data. What you have to do is just enter your email on that site, and it will automatically search the huge archive containing the information that is being stolen or data breach discovered to date and will inform you if and where your personal information is present.

To make it more clear, Troy Hunt has also stated that, “the database contains only email addresses, and ‘Have I been Pwned’ does not keep track of anything else.”

In case if you have been “Pwned,” then the best precautionary measure that you can take right now is, immediately change your passwords for each of your online accounts.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles