Story image

Chinese threat actor linked to leak of more than 200 million Japanese PII datasets

21 May 18

More than 200 million pieces of personal information harvested from Japanese website databases have been spotted for sale on underground forums.

Leaked personal information includes names, credentials, email addresses, dates of birth, phone numbers, and home addresses.

Security firm FireEye uncovered the databases for sale in December 2017 and says the information is most likely authentic.

The Japanese databases were harvested from May-July 2013 and May-June 2016 and appear to be from between 11-50 websites. The websites include those in the retail, entertainment, financial, food and beverage, and transportation sectors.

FireEye believes the data is genuine for a number of reasons, particularly because the data was varied and not available through public data sources. However, many of the datasets were duplicates.

“Out of a random sample of 200,000 leaked email addresses, the majority were previously leaked in major data leaks. This indicates that the email addresses sold in these datasets were unlikely to be fabricated specifically for this data leak,” FireEye adds.

According to a sample of more than 190,000 credentials, 36% contained duplicate values. There were also fake email addresses, suggesting that the number of genuine credentials and sets of PII is ‘significantly lower than advertised’, FireEye says.

“Due to the low-profile nature of most of these websites and possible negative effects on the actor's reputation, the actor selling the data has little incentive to falsify the data sources,” the firm adds.

The threat actor, who was asking ¥1,000 CNY ($150.96 USD), has been selling databases on Chinese underground forums since 2013. While several buyers were interested in buying the dataset, many complained that they did not get the product that was advertised.

The identity of the seller behind this latest dataset is connected to a personal living in China’s Zheijiang province, FireEye speculates.

“The actor sells data exfiltrated from websites in China, Taiwan, Hong Kong, European countries, Australia, New Zealand, and North American countries. We also found two other personas likely connected to this actor through a common QQ address. This QQ address is also connected to an individual living in China’s Zhejiang province,” FireEye explains.

“As the actor has a significant portion of negative reviews on underground forums, it is still possible that the information is fabricated or contains data previously sold by the actor. Notably, negative reviews linked to this vendor claim that the actor does not deliver data or does not provide the product that the buyer expected.”

The company warns that while the dataset will most likely not precede large-scale attacks against entities or individuals caught in the leak, the information could be used to target other entities if individuals reused credentials between the compromised websites and other personal or business-related accounts.

“The lists of leaked email addresses and PII can also facilitate identity theft, spam and malware propagation, and fraud,” FireEye concludes.

Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
Exclusive: Fileless malware driving uptake of behavioural analytics
Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).