Sep 18 2023

FBI HACKER USDOD LEAKS HIGHLY SENSITIVE TRANSUNION DATA

Category: Data Breach,data security,Hackingdisc7 @ 11:36 am

Researchers fromĀ vx-undergroundĀ reported that FBI hackerĀ ā€˜USDoDā€˜ leaked sensitive data from consumer credit reporting agency TransUnion.

TransUnionĀ is an AmericanĀ consumer credit reporting agency. TransUnion collects and aggregates information on over one billion individual consumers in over thirty countries, including ā€œ200 million files profiling nearly every credit-active consumer in the United Statesā€.

A threat actor who goes by the moniker ā€œUSDoDā€ announced the leak of highly sensitive data allegedly stolen from the credit reporting agency. The leaked database, over 3GB in size, contains sensitive PII of about 58,505 people, all across the globe, including the America and Europe

According to researchersĀ vx-undergroundĀ who reported the leak, the archive contains data that dates back to March 2nd, 2022, which could be the data of the data breach.

This leaked database has information on individuals all across the globe including the Americas (North and South), as well as Europe

vx-undergroundĀ states that leaked data includes individual first name, last name, Internal TransUnion identifiers, sex, passport information, place of birth, date of birth, civil status, age, current employer, information on their employer, a summary of financial transactions, credit score, loans in their name, remaining balances on the loans, where they got the loan from, when TransUnion first began monitoring their information.

The name USDoD is well known in the cyber security sector, it was also listed in the indictment for the notorious owner of the BreachForums cybercrime forumĀ Pompompurin.Ā vx-undergroundĀ pointed out that they are believed to be behind many other high-profile security breaches.

Recently, The multinationalĀ aerospaceĀ corporation AirbusĀ announced that it is investigating a data leakĀ after cybersecurity firm Hudson Rock reported that a hacker posted information on thousands of the companyā€™s vendors to the dark web.

ā€œUSDoDā€ announced he had gained access to an Airbus web portal by compromising the account of a Turkish airline employee.

The hacker claimed to have details on thousands of Airbus vendors. The threat actors obtained the personal information of 3,200 individuals associated with Airbus vendors, exposed data include names, job titles, addresses, email addresses, and phone numbers. 

In December 2022, the FBIā€™s InfraGard US Critical Infrastructure Intelligence portalĀ was hackedĀ and a database containing the contact details of more than 80,000 high-profile private sector individuals was offered for sale by USDoD on the Breached cybercrime forum.

After the law enforcement shutdown of ā€œBreachedā€ forum, its members, including ā€œUSDoD,ā€ moved to other platforms such as ā€œBreachForums.ā€

ā€œUSDoDā€ posted two threads on this new forum, one to announce they have joined the notorious ransomware group Ransomed. In the second threat, the hacker exposed the personal information of 3,200 sensitive Airbus vendors. USDoD also warned that Lockheed Martin and Raytheon might be the next targets.

ā€œThreat actors typically refrain from revealing their intrusion techniques, however in this exceptionally rare leak, ā€œUSDoDā€ revealed they gained access to Airbusā€™s data by exploitingĀ ā€œemployee access from a Turkish Airlineā€.ā€Ā reported Hudson Rock. ā€œUsing this information, Hudson Rock researchers succeeded to trace the mentioned employee access ā€” a Turkish computer infected with an info-stealing malware in August 2023.ā€

According to the researchers, the computer of the victim was likely infected with theĀ RedLine stealerĀ after he attempted to download a pirated version of the Microsoft .NET framework.

A Business Guide for Protecting Sensitive Information

InfoSec toolsĀ |Ā InfoSec servicesĀ |Ā InfoSec booksĀ |Ā Follow our blogĀ |Ā DISC llc is listed on The vCISO Directory

Tags: SENSITIVE TRANSUNION DATA