While the proprietor of the post at first guaranteed that the information had been stolen from CityBee at some point in 2020, it was subsequently affirmed that the database was exfiltrated from an unsecured Microsoft Azure blob managed by CityBee at least from February 2018. Apparently, a Rapid7 Open Data Forward DNS tool was utilized to look through the reverse DNS lookup, which was how the threat actor found the unsecured CityBee blob. At that point, a directory brute-force attack was used to enumerate directories in the blob, after which the threat actor downloaded the files.
“The data, which was uploaded to one of the cyber hackers favourite forums, is three years old,” CityBee said in a statement. A poster on the hacker forum said the rundown was extricated from data grabbed on February 2018 from an unsecured database backup and offered full hacked information for $1,000 paid in Bitcoin. Disclosure of stolen client information won't influence the security of CityBee client financial services, as the organization doesn't gather delicate data identified with client payment methods.
“We are very sorry. I am one of the victims of the leak because I use the service, and I very well understand that feeling of insecurity,” CityBee CEO Kristijonas Kaikaris told journalists on Tuesday. He proposed the hacked clients “don’t panic” and change their passwords. The organization risks a fine of as much as 20 million euros ($24.21 million), or 4% of its turnover if found in breach of regulations.