Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label B2B. Show all posts
User Security
B2B Data Breach Data Leak Demand science User Security

Data Aggregator Breach Exposes Data of 122 Million Users

 

Pure Incubation, currently known as DemandScience, allegedly experienced a data breach earlier this year, resulting in the theft of critical data, including contact information. 

The impacted entity is a B2B demand-generation and data aggregator that collects, collates, and organises data from public sources to create a comprehensive dataset that digital marketers and advertisers can use to create rich "profiles" for lead generation or marketing material. 

Furthermore, this organisation gathered data from public and third-party sources, including full names, physical addresses, email addresses, phone numbers, employment titles and positions, and social media links. 

The alleged cause of the data breach is an unsecured system on Pure Incubation, which allowed a threat actor known as 'KryptonZambie' to sell around 132.8 million documents on BreachForums starting last February.

On the other side, the data aggregator persisted on one of the enquiries, stating that there was no evidence of a hack. However, a follow-up email asking if the leaked data samples belonged to them went unanswered.

Furthermore, the senior director of corporate communications stated that a post from a black hat hacker criminal website triggered them to activate their security and incident response systems. The company also stated that its systems are completely working and that its first investigation did not find any sign of a hack or data breach. Still, it assured every concerned party that it constantly monitored the issue. 

On August 15, 2024, KryptonZambie made the dataset available for eight credits, which is equivalent to a few dollars. This disclosure forced the company to verify the data's legitimacy. However, the confirmation stated that anyone who was exposed to the DemandScience leak did so through a system that had been discontinued two years ago. 

The 122 million unique email addresses from the stolen dataset have been added to Have I Been Pwned, and impacted subscribers will be notified of the incident. Therefore, the individuals who may have been affected by the data leak should be vigilant of any unsolicited contacts, since threat actors can already carry out targeted phishing operations.
Read more »
User Privacy
B2B Data Breach Microsoft Privacy Policy SOC User Privacy

Microsoft Reveals 65,000 Companies' Data Breach

 

In response to a security breach that left an endpoint freely available over the internet without any authentication, Microsoft this week acknowledged that it unintentionally exposed data related to customers.

The IT giant was contacted on September 24, 2022, when the cybersecurity intelligence company SOCRadar identified the data leak.

2.4 TB of privileged data, such as names, phone numbers, email addresses, company names, and connected files containing information like proof-of-concept documents, sales data, and product orders, may have been exposed due to a compromised Azure Blob Storage, according to SOCRadar, which claims to have informed Microsoft upon its findings.

Microsoft highlighted that there was no security flaw to blame for the B2B leak, which was "generated by an unintended misconfiguration on an endpoint that is not used across the Microsoft ecosystem." However, Microsoft has contested the scope of the problem, claiming that the information in question included names, email addresses, email content, company names, contact numbers, and attached files pertaining to transactions between such a user and Microsoft or an authorized Microsoft partner.

Organizations can find out if their data were exposed thanks to a website called BlueBleed that SOCRadata set up. "According to our study, the leak, known as BlueBleed Part I, contains crucial data that belongs to more than 65,000 companies from 111 countries. So far, the leaks have exposed 548,000 individuals, 133,000 projects, and more than 335,000 emails," as per the SOCRadar researchers. 

Additionally, Redmond highlighted its dissatisfaction with SOCRadar's choice to make a public search function available, claiming that doing so exposes users to unnecessarily high-security risks.

In a follow-up post published on Thursday, SOCRadar compared the BlueBleed search engine to the 'Have I Been Pwned' data breach notification tool, presenting it as a way for businesses to determine whether their data had been compromised in a cloud data leak.

The research company maintains that it did not violate any privacy policies while conducting its investigation and that none of the data it found were saved on its end. According to SOCRadar's VP of Research and CISO Ensar Eker, "No data was downloaded, Some of the data were crawled by our engine, but as we promised to Microsoft, no data has been given so far. All this crawled data was erased from our servers."

Microsoft has not yet made any specific figures concerning the data breach available to the public.


Read more »
information exposed
643 GB Amazon Web Services B2B Bizongo Data Breach India information exposed

643GB of Customer Information Exposed in a Data Breach Suffered by Bizongo

 

The issue of data fraud has been on a rapid rise, as of late, and evidently so as data breaches are a matter of serious concern for data applications in all aspects of life. In recent days, few Indian start-ups have suffered several data violations. 

In the light of that, an alarming data violation within the packaging acquisition company Bizongo, a digital platform located in Mumbai, India, was discovered by the Website Planet Security Team. As just at end of December 2020, the team disclosed an incorrect bucket belonging to Bizongo that leaves highly confidential data potentially exposed to hackers and other unauthentic sources. Due to the complexity of the breach, more than a thousand organizations and hundreds of thousands of people could be affected. 

The key concern of Bizongo is serving Indian firms and there is no indication that their facilities extend beyond Indian borders. While its website domain has just been altered to 'dotcom,' it indicates that international companies have the potential of becoming a part of Bizongo. 

With more than 400 customers across multiple sectors, Bizongo is an online packing market, with over 860 million packings shipped to date. With customers using their Business to Business (B2B) supply chain and vendor management systems, Bizongo has disclosed almost 2.5 million (643Gb) data files that contain names, addresses, billing numbers, and customer payment information, with Amazon, Flipkart, Myntra, Swiggy and Zomato being some of their prime customers. 

A malfunctioning Amazon Web Services (AWS) S3 bucket operated by Bizongo was indeed the cause of the data leak as per the security team of Website Planet. There were two kinds of files in the bucket — customer bills and dispatch labeling. 

In a blog post, the Website Planet wrote, “With clear examples of branded shipping labels and customer receipts, finding the owner of the breached database was reasonably straightforward. All of the exposed data was identified as accurate, with the data belonging to real individuals.” 

The exact period during which this data wasn’t secured is currently unclear. The team, nevertheless, noted that the violation was detected and registered on 30 December 2020. While Bizongo has never responded to this data breach, on 8 January 2021, when the breach was closed, the website planet security staff revised the bucket anyway. 

Although the Indian data security legislation has not been enforced yet, Bizongo remains guilty of almost any misreporting of personal data. Affected individuals have a legitimate right to pursue civil proceedings and reimbursement. 

Any Indian company or packaging provider using the Bizongo platform also faces the possibility of this infringement affecting them. Concerned parties should seek further clarification from Bizongo themselves on their data and this violation. Since they cannot be sure if non-ethical attackers and fraudsters access unsecured data. However, the information leaked is likely to be detected, so users should be mindful of a variety of risks. 

“We take data security very seriously and implement best security practices to keep our and our customer data secure. We have taken strong measures to prevent such accidental misconfiguration from happening in the future,” the Bizongo added.
Read more »
Subscribe to: Posts (Atom)