sb-nz logo
Story image

Chinese threat actor linked to leak of more than 200 million Japanese PII datasets

21 May 2018

More than 200 million pieces of personal information harvested from Japanese website databases have been spotted for sale on underground forums.

Leaked personal information includes names, credentials, email addresses, dates of birth, phone numbers, and home addresses.

Security firm FireEye uncovered the databases for sale in December 2017 and says the information is most likely authentic.

The Japanese databases were harvested from May-July 2013 and May-June 2016 and appear to be from between 11-50 websites. The websites include those in the retail, entertainment, financial, food and beverage, and transportation sectors.

FireEye believes the data is genuine for a number of reasons, particularly because the data was varied and not available through public data sources. However, many of the datasets were duplicates.

“Out of a random sample of 200,000 leaked email addresses, the majority were previously leaked in major data leaks. This indicates that the email addresses sold in these datasets were unlikely to be fabricated specifically for this data leak,” FireEye adds.

According to a sample of more than 190,000 credentials, 36% contained duplicate values. There were also fake email addresses, suggesting that the number of genuine credentials and sets of PII is ‘significantly lower than advertised’, FireEye says.

“Due to the low-profile nature of most of these websites and possible negative effects on the actor's reputation, the actor selling the data has little incentive to falsify the data sources,” the firm adds.

The threat actor, who was asking ¥1,000 CNY ($150.96 USD), has been selling databases on Chinese underground forums since 2013. While several buyers were interested in buying the dataset, many complained that they did not get the product that was advertised.

The identity of the seller behind this latest dataset is connected to a personal living in China’s Zheijiang province, FireEye speculates.

“The actor sells data exfiltrated from websites in China, Taiwan, Hong Kong, European countries, Australia, New Zealand, and North American countries. We also found two other personas likely connected to this actor through a common QQ address. This QQ address is also connected to an individual living in China’s Zhejiang province,” FireEye explains.

“As the actor has a significant portion of negative reviews on underground forums, it is still possible that the information is fabricated or contains data previously sold by the actor. Notably, negative reviews linked to this vendor claim that the actor does not deliver data or does not provide the product that the buyer expected.”

The company warns that while the dataset will most likely not precede large-scale attacks against entities or individuals caught in the leak, the information could be used to target other entities if individuals reused credentials between the compromised websites and other personal or business-related accounts.

“The lists of leaked email addresses and PII can also facilitate identity theft, spam and malware propagation, and fraud,” FireEye concludes.

Story image
O365 a weak point ripe for exploit, say security professionals
71% of more than 1,000 security professionals have been on the receiving end of a Microsoft 365 account takeover, on average, seven times in the last year alone.More
Link image
Virtual demo: Diagnose network cabling problems with the LinkIQ Cable+Network Tester
If you’re finding it difficult to install access points and cabling, or if you can’t pinpoint an issue with a video camera or end user, the LinkIQ Cable+Network Tester could be exactly what you need. Try a free, fully interactive demo now.More
Story image
Need for greater understanding of data security responsibility as cloud adoption grows - report
Despite the accelerated adoption of cloud services, there was a lack of clarity and confidence regarding the protection and recovery of data stored in public clouds.More
Story image
5G network security a US$9 billion dollar opportunity - report
The cloud-native nature of 5G networks will have a disruptive and positive impact on the cybersecurity industry in the next few years, with 5G network security presenting a US$9 billion enterprise market opportunity by 2025.More
Story image
Kroll completes Redscan acquisition, expands cyber risk portfolio
With the addition of Redscan and its extended detection and response (XDR) enabled security operations centre (SOC) platform, Kroll expands its Kroll Responder capabilities to support a wider array of cloud and on-premise telemetry sources.More
Story image
Microsoft Exchange breach a wake-up call to ditch the server
"There are owners who still have in-house exchange servers because they are suspicious of the cloud or have concerns about their data sovereignty or don't want to contemplate the capital expenditure. But the warning is clear. Get rid of them."More