Over Three Million US Drivers Exposed in Data Breach

Over 3 million buyers of a US auto corporation have experienced their details compromised soon after a cyber-legal posted them to a dark web forum, according to Risk Dependent Security.

The security vendor spotted a number of databases uploaded to a hacking forum on January 4 this year, even though the details dump evidently took area on December 19 2020.

It traced them back again to DriveSure, an Illinois-centered enterprise owned by car dealership support provider Krex. Its web site describes that the business assists its consumers to develop potent buyer relationships to really encourage drivers back to dealerships for car or truck service and unplanned repairs.

On discovering the forum put up, Risk Primarily based Security dug further to validate the details from many databases. This bundled names, dwelling and email addresses, phone numbers, car or truck and harm information, text and email messages with dealerships, and in excess of 93,000 bcrypt hashed passwords.

Despite the fact that more robust than SHA1 and MD5, bcrypt could nevertheless be brute-pressured if password strength is lousy, stated Risk Primarily based Security.

The vary of facts exposed by the attacker appeared to be considerable.

“One leaked folder totalled 22GB and integrated the company’s MySQL databases, exposing 91 sensitive databases. The databases selection from thorough dealership and stock data, profits data, stories, claims,and customer details,” Risk Dependent Security discussed.

“Separately, the 2nd compromised folder contained 11,474 information in 105 folders and amassed to 5.93GB. Self-determined as ‘parser documents,’ they seem to be logs and backups of their databases and include the identical facts stated in the beforehand described SQL databases, including to the trove of data.”

A 3rd folder contained a 1.5GB client SQL databases with just about 3.3 million email addresses, which includes pretty much 16,000 .mil and .gov addresses, as effectively as about 5000 connected to S&P 100 corporations, the seller claimed.

“The info leaked in these databases is prime for exploitation by risk actors, and in distinct for insurance policies scams. Criminals can use individually identifiable information and facts, hurt claims, extended motor vehicle aspects and dealer and guarantee information and facts to target insurance businesses and policyholders,” it concluded.

“Moreover, person credentials are utilised by risk actors to split into other worthwhile platforms this kind of as financial institution accounts, particular email accounts and company units. The varied established of consumer details can also be applied to guess and crack security thoughts usually utilised by companies to reset passwords. Commercial email addresses can even be targets for spear-phishing or extortion.”

DriveSure responded promptly to Risk Dependent Security and reportedly reported it is investigating the incident.

Some sections of this posting are sourced from:
www.infosecurity-magazine.com