U.S. firm Frost & Sullivan suffered a data breach, data from an unsecured backup that were exposed on the Internet was sold by a threat actor on a hacker forum.
Frost & Sullivan is a business consulting firm involved in market research and analysis, growth strategy consulting, and corporate training across multiple industries.
The company has 40 offices on six continents and over 1,800 employees.
Early this week, a threat actor known as ‘KelvinSecurity Team’ (aka KelvinSecTeam) attempted to sell company databases on a hacker forum, the dump includes data belonging employees and customers.
According to researchers from InfoArmor, KelvinSecTeam is a probable Russian hacking organization with a robust presence on Deep and Dark Web forums popular with hackers and cybercriminals, with probable team members in Central and South America — and they are growing.
The post published on the forum states that the databases contain approximately 6,000 customer records and 6,146 records for companies.
The employee database includes first and last names, login names, email addresses, and hashed passwords.
Exposed customer records include client name, email address, the company contact, whether they are confidential, and other data.
“In a conversation with Beenu Arora, CEO of cybersecurity intelligence firm Cyble, BleepingComputer was told that the data breach was caused by an unsecured backup folder that contained databases and company documents.” reported BleepingComputer.
“The breach occurred to a misconfigured backup directory on one of Frost and Sullivan public-facing servers. The backup directory had its employees and customers records, along with other confidential information,” said Arora.
KelvinSecurity Team told BleepingComputer that they attempted to report its findings to the company but received no response, then they decided to offer the data for sale.
KelvinSecurity claims that they have yet to sell the databases and that they will suspend the sale in case Frost & Sullivan will contact them.
(SecurityAffairs – hacking, Frost & Sullivan)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.