Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Data Stolen From 945 Websites Emerges on Dark Web

SQL databases allegedly stolen from 945 websites have emerged on the Dark Web, potentially impacting tens of millions of people, Lucy Security reports.

The collection contains information from a variety of sites worldwide, which appear to have been breached by different hackers, but not by the entity offering them on the Dark Web.

SQL databases allegedly stolen from 945 websites have emerged on the Dark Web, potentially impacting tens of millions of people, Lucy Security reports.

The collection contains information from a variety of sites worldwide, which appear to have been breached by different hackers, but not by the entity offering them on the Dark Web.

On June 1 and June 10, the threat actor released two databases containing a total of 150 GB of unpacked SQL files, Lucy Security reveals.

The offered files include a broad range of personal data, including full names and phone numbers, emails, usernames, hashed and non-hashed passwords, IP addresses, and physical addresses, along with other information.

“The entity who collected and shared the databases on the dark web claims to have gathered these so-called ‘private’ databases without having committed any hacking by themselves, yet they also claim to possess even more databases, which they are planning to share or sell to the highest bidder,” Lucy Security says.

The targeted websites appear to have less than one million visitors each, based on their Alexa rankings, the security firm also notes.

The Lucy researchers who analyzed the databases reveal that the collection contains entire SQL dumps of the targeted sites, dated between 2017 and 2020. According to them, roughly 14 million users are impacted.

The researchers also identified 14 governmental sites in the collection. These belong to Ukraine, Israel, UK, Belarus, Russia, Lebanon, Rwanda, Pakistan and Kyrgyzstan.

Lucy says that the new data does not appear to be linked to Collection #1, the massive collection of 773 million records that were amassed from different sources and was shared online in January last year.

“This is an entirely new threat; none of the databases were known to the public before,” Lucy says.

Related: Researchers Identify Hacker Behind Massive Data Breach Collection

Related: Security Breach Impacts State Police Database

Related: Design Marketplace Minted Confirms Recent Data Breach

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack

Cybercrime

Artificial intelligence is competing in another endeavor once limited to humans — creating propaganda and disinformation.

Cybercrime

A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...

Cybercrime

The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Cybercrime

A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.

Cybercrime

Cybercriminals earned significantly less from ransomware attacks in 2022 compared to 2021 as victims are increasingly refusing to pay ransom demands.