A former Yandex employee allegedly stole the company's source code repository and leaked it as a Torrent on a notorious hacking forum, causing a stir at the tech giant.
See also: Riot Games hack: League of Legends source code up for auction
Yesterday, the malicious individual posted a magnet link claiming to be “Yandex git sources,” which included 44.7 GB of stolen files from July 2022. According to this leaker, these code repositories include Yandex’s entire source code library, minus anti-spam regulations.
See also: Zacks Investment Research data breach affects 820,000 clients
Software engineer Arseniy Shestakov analyzed the leaked Yandex Git repository and said it contains technical data and code for the following products:
- Yandex search engine and indexing bot
- Yandex Maps
- Alice (AI assistant)
- Yandex Taxi
- Yandex Direct (ad service)
- Yandex Mail
- Yandex Disk (cloud storage service)
- Yandex Market
- Yandex Travel (travel booking platform)
- Yandex360 (workspaces service)
- Yandex Cloud
- Yandex Pay (payment processing service)
- Yandex Metrika (internet analytics)
For those wishing to explore the stolen source code, Shestakov generously provided a directory of the leaked files on GitHub.
See also: CISA: Cyberattacks exploit legitimate remote monitoring software
Yandex told BleepingComputer that its systems were not compromised, but the source code repository was leaked by a former employee.
Based on our security team's investigation, it was determined that Yandex was not compromised. Instead, code snippets from our internal repository were discovered in the public domain - however, this content is outdated and does not reflect what is currently used for Yandex services.
A repository is a tool for storing and working with code. Code is used this way internally by most companies.
Yandex is currently investigating the cause of the disclosure of some parts of the source code, and it does not appear that individual user data or the security of the platform was compromised. The repositories are necessary for working with the code, but cannot be used to store private information.
Information source: bleepingcomputer.com
