Dell allegedly lost info about more than 10,000 employees and partners to a malicious actor because of an internal data breach. On the infamous BreachForums, a hacker using the alias ‘grep’ claims to have captured the names, internal company status and ID numbers of these employees, among other things.
In a forum post, the hacker offered the entire data set for one BreachForum credit. This amounts to about 30 cents. A small portion of the database was allegedly released as evidence. According to the claim, ‘grep’ managed to break in sometime in September of this year. If that is true, Dell employees risk falling victim to phishing campaigns or identity theft.
At worst, criminals will use this data to gain access to Dell internal systems one way or the other, such as by logging in with an employee’s credentials.
Unlocking login information
Even if the dataset does not contain passwords, it is conceivable that other employees could start receiving messages from a ‘colleague’, i.e. or rogue actor, asking for login information or other sensitive details. Dell is investigating the veracity of the claim, the company tells BleepingComputer.
This is not the first time ‘grep” has struck this month. On September 9, he or she claimed responsibility for a break-in at French tech consultancy firm Capgemini. They allegedly captured 20 GB of sensitive data, including source code, private keys, personal information, and details about the configuration of Capgemini and its customers’ cloud infrastructures. The theft may have also included entire databases and backup data, including VM logs from a T-mobile brand.
BreachForums seems to be back
Earlier this year, it seemed that BreachForums had been taken off the air by the FBI. It was apparently a breeze for owners ShinyHunters to get it back on the air. Since then, the criminal marketplace has again played a prominent role in several high-profile data thefts.
For example, information from Ticketmaster and other companies surfaced there, probably due to a hacker known as Judische, 404media reports, after being stolen from Snowflake environments. A dump of nearly 10 billion plaintext passwords also surfaced there in July of this year.
Also read: List of Snowflake customers affected since Ticketmaster leak continues to grow