American business consulting firm Frost & Sullivan was breached when data from a backup folder was exposed online.
Frost & Sullivan is a business consulting firm that helps companies with strategic development, market research , and corporate training. With 40 offices worldwide and more than 1,800 employees, Frost & Sullivan is a well-known consulting firm.
On Monday, a group known as the "KelvinSecurity Team" posted on a hacking forum stating that it was selling various databases related to Frost & Sullivan employees and clients.
KelvinSecurity states that they are “Business Intelligence Contractors,” but an InfoArmor report describes them as a group known for their non-legal activities.
In the forum post, the group states that the data being sold includes 6,000 customer records and 6,146 company records.
In a conversation with Beenu Arora, CEO of cybersecurity intelligence firm Cyble, BleepingComputer was informed that the data breach was caused by an unsecured backup folder containing company databases and documents
“The breach occurred in a misplaced backup folder on one of Frost and Sullivan’s public servers. The folder contained employee and client files, along with other confidential information,” Arora told BleepingComputer.com.
The customer database contained information such as customer names, email addresses, and other non-sensitive data.
On the other hand, the exposed employee database had more sensitive information, such as first and last names, usernames, email addresses , and hashed passwords.
KelvinSecurity says it tried to contact Frost & Sullivan
“The intention was not to take a database and sell it. We tried to contact the company, but like many others, they are not responding to our requests, so we are selling the database to shake up the authorities,” said KelvinSecurity Team.
KelvinSecurity claims it has not sold the data and hopes Frost & Sullivan will contact them “to resolve the matter.”
