Whoosh, a Russian scooter-sharing service, has suffered a data breach, with the details of 7.2 million customers now being sold on a hacking forum.
Whoosh is a leading urban mobility platform in Russia , with over 75,000 scooters operating in 40 cities. As stated on its website, the company wants to offer city dwellers the ability to easily reach any destination that is important to them within 15 minutes.
See also: Killnet group claims to have DDoSed FBI website
“We believe all communities deserve access to smart, affordable transportation,” the company says on its site.
However, Whoosh was the victim of an attack that resulted in a breach of its customer data. On Friday, a hacker began selling the stolen data on a hacking forum. The stolen data allegedly contained promotional codes that could be used to gain free access to the service, as well as partially identifiable customer information and payment card information.
The company confirmed the cyberattack earlier this month, but said its IT specialists were able to deal with it.
In a new statement issued yesterday, Whoosh admitted to the customer data leak and informed its users that it is working with law enforcement to take all necessary steps to stop the distribution of the leaked data
See also: Android malware BadBazaar: Linked to Chinese cyberspies
According to a Whoosh spokesperson, “the leak did not impact sensitive user data, such as account access or transaction information.”
“In addition, our security measures make it impossible for unauthorized individuals to access users' full payment information from their bank cards,” he said.
Whoosh: What customer data is being sold on the hacking forum?
On Friday, a user of the hacking forum “Breached” published a database containing details of 7.2 million customers Whoosh including email addresses, phone numbers and names.
The database also contained part of the payment card details for 1,900,000 users.
The seller claimed that the stolen data included 3,000,000 promotion codes, which users can use to rent Whoosh scooters without having to pay.
The seller says he will sell the data to a maximum of five buyers, at a price of 0.21490980 bitcoin, or $4,200. According to SatoshiDisk – the platform used for the transaction – no buyers have yet come forward.
See also: Greek public and Intellexa: and yet they know each other
The perpetrator claims that the breach and data theft occurred during an attack on Whoosh in November 2022.
Data breaches and leaks
The Russian internet monitoring agency, Roskomnadzor, reported in August 2022 that there had been 40 breaches of Russian companies.
A report released in September by Group-IB said that over 140 databases were discovered being sold illegally and stolen from Russian companies.
The biggest data breach this year (in terms of impact) was that of food delivery app Yandex Food, which led to many other collateral data breaches.
Source: www.bleepingcomputer.com
