Story image

Chinese threat actor linked to leak of more than 200 million Japanese PII datasets

21 May 18

More than 200 million pieces of personal information harvested from Japanese website databases have been spotted for sale on underground forums.

Leaked personal information includes names, credentials, email addresses, dates of birth, phone numbers, and home addresses.

Security firm FireEye uncovered the databases for sale in December 2017 and says the information is most likely authentic.

The Japanese databases were harvested from May-July 2013 and May-June 2016 and appear to be from between 11-50 websites. The websites include those in the retail, entertainment, financial, food and beverage, and transportation sectors.

FireEye believes the data is genuine for a number of reasons, particularly because the data was varied and not available through public data sources. However, many of the datasets were duplicates.

“Out of a random sample of 200,000 leaked email addresses, the majority were previously leaked in major data leaks. This indicates that the email addresses sold in these datasets were unlikely to be fabricated specifically for this data leak,” FireEye adds.

According to a sample of more than 190,000 credentials, 36% contained duplicate values. There were also fake email addresses, suggesting that the number of genuine credentials and sets of PII is ‘significantly lower than advertised’, FireEye says.

“Due to the low-profile nature of most of these websites and possible negative effects on the actor's reputation, the actor selling the data has little incentive to falsify the data sources,” the firm adds.

The threat actor, who was asking ¥1,000 CNY ($150.96 USD), has been selling databases on Chinese underground forums since 2013. While several buyers were interested in buying the dataset, many complained that they did not get the product that was advertised.

The identity of the seller behind this latest dataset is connected to a personal living in China’s Zheijiang province, FireEye speculates.

“The actor sells data exfiltrated from websites in China, Taiwan, Hong Kong, European countries, Australia, New Zealand, and North American countries. We also found two other personas likely connected to this actor through a common QQ address. This QQ address is also connected to an individual living in China’s Zhejiang province,” FireEye explains.

“As the actor has a significant portion of negative reviews on underground forums, it is still possible that the information is fabricated or contains data previously sold by the actor. Notably, negative reviews linked to this vendor claim that the actor does not deliver data or does not provide the product that the buyer expected.”

The company warns that while the dataset will most likely not precede large-scale attacks against entities or individuals caught in the leak, the information could be used to target other entities if individuals reused credentials between the compromised websites and other personal or business-related accounts.

“The lists of leaked email addresses and PII can also facilitate identity theft, spam and malware propagation, and fraud,” FireEye concludes.

How to stay safe when shopping online
Online shopping is a great way to avoid the crowds – but there are risks.
Dell EMC embeds security in latest servers
Dell EMC's 14th generation of PowerEdge servers has comprehensive management tools to provide security across hardware and firmware.
Why data backups should be a part of daily operations
"Disaster recovery needs to address complete system failure and provide a set of security policies to govern disaster incidents."
Businesses focusing on threats from within - survey
Over 50% of respondents reported that 100 days of dwell time or more was representative of their organisation.
Corelight and Exabeam partner to improve network monitoring
The combination of lateral movement and siloed usage of point security products leaves many security teams vulnerable to compromise.
SailPoint releases first identity annual report
SailPoint’s research found that many organisations are lacking maturity in their governance processes over identities.
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.