Threat Actor Dumps 1.9 Million Pixlr Records Online

A notorious threat actor appears to have published 1.9 million consumer information for the well known on the internet photo editing site Pixlr, putting prospects at risk of comply with-on attacks.

“ShinyHunters” dumped the files around the weekend for no cost on an underground discussion board, saying the internet site was breached at the exact time as 123RF, which is owned by the same business, Inmagine.

Among the details up for grabs are email addresses, usernames, hashed passwords and users’ nations around the world.

So much there’s been no phrase from the firm by itself, regardless of the simple fact that these customers could be at risk of phishing attacks, credential stuffing makes an attempt and other fraud if not informed promptly.

ShinyHunters is a prolific actor on the cybercrime underground, obtaining been associated in breaches at Wishbone (40 million documents), Heavenly (1.4 million), Dave (7.5 million) and numerous far more.

If this incident is reputable, as looks the case, Pixlr clients would be recommended to be on the glance-out for ripoffs and to modify their log-ins on the web-site, and any other individuals they share the similar passwords for.

ShinyHunters claimed to have stolen the knowledge from Pixlr’s Amazon Web Expert services (AWS) S3 bucket late last 12 months.

It is unclear how, but CloudSphere VP of item, Pravin Rasiah, warned that misconfigured cloud storage is just one of the major will cause of data breaches.

“The likelihood of leaving an S3 bucket exposed are all far too significant, as inexperienced people can merely opt for the ‘all users’ entry choice, producing the bucket publicly available. Leaving these S3 buckets open up and exposed invitations hackers to exploit the own facts entrusted to firms by their shoppers,” he argued.

“To avoid incidents like this from transpiring, consciousness in the cloud surroundings is imperative.” 

Cloud Security Posture Management (CSPM) instruments are commonly regarded as finest practice in this space, as they repeatedly watch these kinds of environments for configuration problems.

Some parts of this post are sourced from:
www.infosecurity-journal.com