November 13, 2024 at 04:46PM
Over 183 million records of contact and employment information are reportedly for sale by a cybercriminal, known as KryptonZambie, on a crime forum for $6,000. The data is claimed to be publicly available and sourced from DemandScience, which denies any breach. Security incidents related to the data have been reported.
**Meeting Takeaways: Data Breach Overview**
1. **Incident Summary**: Over 183 million records containing personal contact details and employment information allegedly stolen from data broker, Pure Incubation (now DemandScience), are being sold by a cybercriminal using the name KryptonZambie for $6,000.
2. **Data Description**: The offered data includes corporate email addresses, physical addresses, phone numbers, names of employers, job titles, and social media profile links. A sample of 100,000 records is available for potential buyers.
3. **Data Source Clarification**:
– DemandScience stated that the information sold is likely publicly available and clarified that they only process publicly available business contact details, not sensitive personal information like home addresses or credentials.
– The company does not believe the data was obtained through a direct IT security breach.
4. **Data Brokerage Insights**: The situation highlights the cycle of data brokering, where one entity collects publicly available information to sell, and another entity subsequently acquires and sells this data, often leading to privacy issues.
5. **Legal Recourse**: Residents in California have the option to opt out of DemandScience’s data sales.
6. **Monitoring and Reporting**: The data dump was flagged by Have I Been Pwned (HIBP) and added to their security incident list. The data for sale includes at least 122 million unique email addresses.
7. **Personal Experience Shared**: Troy Hunt, HIBP founder, discovered his own outdated email and incorrect job title in the data. He expressed his frustration with the incident publicly.
8. **Credibility Note**: The claims made by KryptonZambie regarding the volume and nature of the data have not been independently verified by HIBP or The Register.
**Action Items**:
– Monitor further developments regarding this data breach.
– Consider implications for data security practices and customer notifications.
– Evaluate potential strategies to strengthen data protection measures.