The data breach was discovered by security researcher Bob Diachenko, who worked with fellow researcher Vinny Troia to count the number of exposed records and identify who was exposing them.
Diachenko and Troia found that the data trail quickly led them to Verifications.io, a site that offers an “enterprise email validation” service. Wired found that this vast set of individual data is unusual since it contains additional data about individual consumers as well as what appears to be “business intelligence data,” such as employee and revenue figures from various companies.
Commenting on the data breach, Tom Patterson, Chief Trust Officer at Unisys told Digital Journal: “Organizations that aggregate large volumes of consumer data continue to be targets of major cyber-attacks. Whether attribution eventually points to trans-national criminal gangs with a profit motive, foreign intelligence services with at globally strategic motive, home-grown or insiders with an axe to grind, or terrorists building their own files, the result for the hundreds of millions of compromised persons is the same.”
Expanding on the data loss further, Patterson said: “Sectors that are in the middle of big things, including advertising, legal, accounting, shipping, and more, must no longer rely on security by their obscurity. Global adversaries know who they are, and they now have a cyber-target painted on their logo.”
READ MORE: 809 million emails leaked from accessible MongoDB database
Also weighing in on the incident, Cindy Provin, CEO at nCipher Security explains just how bad the data breach is: “A leak of 763 million records is massive. Not only were emails publicly accessible for anyone with an internet connection, but phone numbers, birth dates, mortgage amounts, interest rates and social media accounts were also exposed.”
She adds: “This is like winning a lottery for cyber-criminals who can easily piece together the information and use it as bait for phishing attacks and identity theft to cash in on even more sensitive information.”
Provin also contextualizes the data loss and what it means for businesses and users: “A leak of this magnitude certainly validates what we heard from consumers in a recent survey about cyber-security: 68 percent of Americans fear identity theft – and for good reason. Organizations need to be vigilant in today’s cybereconomy and extend their encryption policies to cover all personally identifiable information, so that it becomes useless should it fall into the wrong hands.”
