Hacker is selling 34 million user records stolen from 17 companies

[tarekma7]

A threat actor is selling account databases containing an aggregate total of 34 million user records that they claim were stolen from seventeen companies during data breaches.

On October 28th, a data breach broker created a new topic on a hacker forum to sell the stolen user databases for seventeen companies.

In a conversation with BleepingComputer, the seller told us that they were not responsible for hacking into the seventeen companies and is acting as a broker for the databases.

When asked how the hacker gained access to the various sites, the seller stated, "Not sure if he want to disclose."

Stolen databases are typically sold first in private sales, like those listed above, with previous ranging from $500, as seen in the Zoosk data breach, to $100,000 for the Wattpad database.

After some time, it is common for the stolen databases to be released for free on hacker forums to increase a threat actor's 'street cred.'

Companies allegedly breached in 2020
According to the data breach broke, all of the seventeen databases being sold were obtained in 2020, with the largest breach being Geekie.com.br with 8.1 million records. The most well-known affected company is Singapore's RedMart that exposed 1.1 million rec

The seller told BleepingComputer that they are selling the RedMart database for $1,500.

None of these companies have previously reported recent data breaches prior to this week.

After BleepingComputer contacted all affected companies, only RedMart disclosed a data breach yesterday, and Wongnai.com told BleepingComputer that they are investigating the incident.

"Thanks for your inquiry, we were aware of this incident last night (Bangkok time) and our tech team have been investigating this matter," Wongnai emailed BleepingComputer.com.

Continue reading HERE