Search This Blog

Showing posts with label Shiny Hunters. Show all posts

ShinyHunters is Leaking Data of all the Big Conglomerates

 

Following the hacking of masked credit and debit card data belonging to crores of Juspay customers, independent cybersecurity analyst Rajshekhar Rajaharia reported on January 6, 2021, that the same hacker, likely branded as 'ShinyHunters,' is now selling databases belonging to three more Indian companies on the Dark Web. 

ShinyHunters, the well-known hacker responsible for exposing the accounts of companies such as Animal Jam, Mashable, Upstox, and 123RF, among others, has returned with yet another high-profile data breach. 

The hacker has recently focused on leaking databases belonging to Indian institutions. While unconfirmed, it is thought that the hacker's extortion efforts failed, and as a result, the hacker leaks the stolen info. 

This time, ShinyHunters has leaked a database belonging to WedMeGood, a prominent Indian wedding planning website that handles everything from location selection to photographer bookings and wedding outfit arrangements. WedMeGood has a website and an app that allows couples planning weddings to find nearby vendors and get ideas and inspiration for their big day. The business is headquartered in Gurgaon and was founded in 2014 by Mehak Sagar Shahani and Anand Shahani. 

According to Hackread.com's review, the database contains 41.5 GB of data, including the city, gender, full names, phone numbers, email addresses, password hashes, booking leads, last login date, account formation date, Facebook unique ID numbers, and holiday summary for Airbnb.

JusPay, a Bengaluru-based digital payments portal, previously stated that their Secure Data Store, which houses sensitive card numbers, had not been accessed or leaked. "Thus, all our customers were secure from any kind of risk. Our priority was to inform the merchants and as a measure of abundant precaution, they were issued fresh API keys though it was later verified that even the API keys in use were safe," the company said. 

The hacker, according to Rajaharia, is the same one who leaked BigBasket info, as confirmed by cybersecurity firm Cyble. BigBasket, one of India's most popular online grocery stores, discovered that its data of over 20 million users had been compromised and was for sale on the dark web for over $40,000 in November of last year. 

"Now, the same hacker group is asking about $10,000 in Bitcoin for the BigBasket database and is also selling the three companies' databases," Rajaharia said. "There is a strong connection between all these recent data leaks, including BigBasket," he added.

BigBasket: Data Breach Leaks 20 Million User Data

 

A threat actor dropped about 20 million Big Basket user reports containing personally identifiable details and hashed passwords on a common hacking forum. 

Headquartered in Bangalore, India – Big Basket is an online food supply service. The company mainly provides its customers with food products in convenience shops, home supplies, and food. Big Basket is a famous grocery delivery service platform that enables consumers to purchase and deliver food online. 

Lately, a popular dealer of data breaches named Shiny Hunters, on the morning of 26th April, published a free database on a hacker website claiming that it has already been stolen from Big Basket. Last year during November, when the same dealer, Shiny Hunter attempted to sell the data stolen via private sales on some hacking websites, Big Basket confirmed to Bloomberg News that it had experienced a data breach. 

“There’s been a data breach and we’ve filed a case with the cybercrime police,” Big Basket CEO Hari Menon told Bloomberg News. “The investigators have asked us not to reveal any details as it might hamper the probe.” 

The entire database, which is estimated to be containing over 20 million user records, now has been published for free. It contains e-mail addresses, SHA1 hashed passwords, addresses, phone numbers, and various other details.

The forum members have claimed to have already cracked 2 million passwords by using the SHA1 algorithm. Another Member says 700k of the clients have used their accounts with the password as, 'password.' Shiny Hunters have executed several other data breaches in the past including Tokopedia, Tee Spring, Minted, Chat books, Dave, Promo, Mathway, Wattpad, and more. 

The event happened weeks after the Indian Tata Group decided to purchase Big Basket, at an increase of over $1.8 billion in the value of Indian start-ups. Approval by the Indian Regulator is currently pending in the acquisition plan. 

As Bleeping Computer has also verified that certain documents are correct, like Big Basket's personal information, consumers should be confident in keeping it safe and believing that customer data has been leaked too. It is highly recommended that all Big Basket users update their passwords immediately with the same password on Big Basket and all other pages.