Hacker claims to have stolen databases containing 34 million user records from 17 companies and is now selling them on an underground forum . On October 28, a seller of stolen data created a new topic on a hacking forum to sell the stolen databases. The seller told BleepingComputer that he was not behind the hack of the 17 companies himself but was acting as a “broker” for the databases. When asked how the hacker gained access to various sites, the seller said he was “not sure if he wanted to reveal that.”
Stolen databases are sold at various prices on hacking forums, with previous prices ranging from $500, as seen in the Zoosk data breach , to $100,000, as was the case with the Wattpad database . However, after a period of time, these are usually made available for free.
And the 17 companies whose databases were stolen, breached in 2020. The biggest breach occurred at Geekie.com.br, from’where over 8 million files were stolen. The most well-known company affected is RedMart of Singapore, from which over 1 million files were stolen. The seller reported to BleepingComputer that he is selling RedMart's database for $1,500.
It is worth noting that almost none of the affected companies officially announced that they suffered a data breach. According to the vendor, each breach exposes the following information:
- Redmart.lazada.sg: emails, SHA1 passwords, email and billing addresses, full names, phone numbers, credit card numbers and expiration dates.
- Everything5pounds.com: emails, passwords , names, gender, phone numbers
- Geekie.com.br: emails, bcrypt-sha256/sha512 passwords, usernames, names, DoB, gender, mobile phone numbers, Brazilian CPF numbers
- Wongnai.com: email, md5 passwords, ip, Facebook and Twitter ID, names, dates of birth, phone numbers, zip
- Toddycafe.com: emails, passwords, names, phone numbers, addresses
- Game24h.vn: emails, md5 passwords, usernames, dates of birth, names
- Wedmegood.com: email, sha512 passwords, phone numbers, Facebook ID
- Cermati.com: – emails, bcrypt passwords, names, addresses, phone numbers, income, bank account details, tax numbers, ID numbers, gender
- Clip.mx: email, phone numbers
- Katapult.com: email, pbkdf2-sha256 passwords, names
- Eatigo.com: email, md5 passwords, names, phone numbers, gender, Facebook ID and token.
- Athletico.com.br: email, md5 passwords, names, cpf, dates of birth
- Fantasycruncher.com: email, bcrypt/sha1 passwords, usernames, ip
- W3layouts.com: – email, bcrypt passwords, IP, country, city, state, phone numbers, names
- Apps-builder.com: email, md5crypt passwords, ip, names, country
- Invideo.io: emails, bcrypt passwords, names, phone numbers
- Coupontools.com: emails, bcrypt passwords, names, phone numbers, gender, dates of birth
The exposed email addresses correspond to accounts from 13 of the alleged 17 companies breached by the hacker. Verification of accounts for Clip.mx, Katapult, CouponTools and Aps-builder.com was not possible.
