# data[].attributes.headline
Dropbox hack 'affected 68 million users'

# data[].attributes.subject
Dropbox hack 'affected 68 million users'

# data[].attributes.body
62xxxxxx Nichnan Kittiphattanabawon

# data[].attributes.attachment_link.readable_text
A Dropbox security breach in 2012 has affected more than 68 million account holders, according to security experts.

Last week, Dropbox reset all passwords that had remained unchanged since mid-2012 "as a preventive measure".

In 2012, Dropbox had said hacks on " other websites" had affected customers who used their Dropbox password on other sites too.

But now what purports to be the details of 68.6 million Dropbox accounts have emerged on hacker trading sites.

The 5GB document has been acquired by a Motherboard reporter, who also said it had been verified as genuine by a "senior Dropbox employee" speaking on the condition of anonymity.

The data includes email addresses and hashed passwords.

But security researcher Troy Hunt, who has also seen the document, said the hashing algorithm that obscured the passwords was "very resilient to cracking".

"Frankly, all but the worst possible password choices are going to remain secure even with the breach now out in the public," he said.

Mr Hunt said he had managed to independently verify the hack by finding the password of his wife within the cache.

He told BBC News the document contained a "very unique, 20-character, completely random password" used by his wife to login to Dropbox.

It had been created by a password manager, he said, making the chance of it having been correctly guessed "infinitely small".

Mr Hunt wrote his blog: "There is no doubt whatsoever that the data breach contains legitimate Dropbox passwords - you simply can't fabricate this sort of thing."

Security researcher Ken Munro also said the hack appeared to be genuine and to have "taken place in 2012".

In a statement sent to the BBC, Dropbox said: "This is not a new security incident."

And there was "no indication" Dropbox user accounts had been improperly accessed.

"Our analysis confirms that the credentials are user email addresses with hashed and salted passwords that were obtained prior to mid-2012," said the statement.

"We can confirm that the scope of the password reset we completed last week did protect all impacted users.

"Even if these passwords are cracked, the password reset means they can't be used to access Dropbox accounts."

Meanwhile, on Tuesday the password management service OneLogin - of which Dropbox is a client - revealed that a user gained access to one of its systems used for log storage and analytics.

Alvaro Hoyos, chief information security officer at OneLogin, has said that this incident is not connected to the Dropbox hack.

"We have no indication that OneLogin's August 2016 incident is connected to any further incidents currently in the news," Mr Hoyos told the BBC.

"To reiterate what our recent blog post stated, the impacted system is a standalone system and there are no signs of suspicious activity in any of our other systems.

"The security of our customers is of the utmost importance and we are carrying out an extensive investigation in partnership with a third-party cybersecurity firm. We are advising impacted customers as soon as any additional information becomes available as a result of the investigation."

More on this story

# data[].attributes.attachment_link.title
Dropbox hack 'affected 68 million users'

# data[].attributes.attachment_link.description
A Dropbox security breach in 2012 has affected more than 68 million account holders, according to security experts. Last week, Dropbox reset all passwords that had remained unchanged since mid-2012 "as a preventive measure". In 2012, Dropbox had said hacks on " other websites" had affected customers who used their Dropbox password on other sites too.

# data[].attributes.body
ID Firstname Lastname

# data[].attributes.attachment_link.readable_text
A database containing 250 million Microsoft customer records has been found unsecured and online
NurPhoto via Getty Images

A new report reveals that 250 million Microsoft customer records, spanning 14 years, have been exposed online without password protection.

Microsoft has been in the news for, mostly, the wrong reasons recently. There is the Internet Explorer zero-day vulnerability that Microsoft hasn't issued a patch for, despite it being actively exploited. That came just days after the U.S. Government issued a critical Windows 10 update now alert concerning the "extraordinarily serious" curveball crypto vulnerability. Now a newly published report, has revealed that 250 million Microsoft customer records, spanning an incredible 14 years in all, have been exposed online in a database with no password protection.

What Microsoft customer records were exposed online, and where did they come from?

Paul Bischoff, a privacy advocate and editor at Comparitech, has revealed how an investigation by the Comparitech security research team uncovered no less than five servers containing the same set of 250 million records. Those records were customer service and support logs detailing conversations between Microsoft support agents and customers from across the world. Incredibly, the unsecured Elasticsearch servers contained records spanning a period from 2005 right through to December 2019. When I say unsecured, I mean that the data was accessible to anyone with a web browser who stumbled across the databases: no authentication at all was required to access them, according to the Comparitech report.

The nature of the data appears to be that much of the personally identifiable information was redacted. However, the researchers say that many contained plain text data including customer email addresses, IP addresses, geographical locations, descriptions of the customer service and support claims and cases, Microsoft support agent emails, case numbers and resolutions, and internal notes that had been marked as confidential. This may seem like no big deal in the overall scheme of things, but when you consider that Microsoft support scams are pretty rampant, it doesn't take a genius to work out how valuable such information would be to the fraudsters carrying out such attacks.

How was the Microsoft data exposure discovered, and how long did it take to lock down?

On December 28, 2019, the databases in question were discovered and indexed by threat intelligence search engine BinaryEdge. The following day, Bob Diachenko, who headed up the Comparitech security research team, spotted them and notified Microsoft. "I immediately reported this to Microsoft, and within 24 hours, all servers were secured," Diachenko said. Considering the time of year, this was a remarkably quick response. That said, it was also a remarkably serious leak.

Eric Doerr, general manager at the Microsoft Security Response Center, said: "We're thankful to Bob Diachenko for working closely with us so that we were able to quickly fix this misconfiguration, analyze data, and notify customers as appropriate."

It's not known at this point if the databases were accessed by any else during the time that they were exposed online.

In a Microsoft Security Response Center posting dated January 22, Microsoft said that "the investigation found no malicious use, and although most customers did not have personally identifiable information exposed, we want to be transparent about this incident with all customers and reassure them that we are taking it very seriously and holding ourselves accountable."

That posting also confirmed that the exposure of the database started on December 5, 2019, as the result of misconfigured security rules, and was remediated on December 31. The statement included an apology from Microsoft: "We want to sincerely apologize and reassure our customers that we are taking it seriously and working diligently to learn and take action to prevent any future reoccurrence."

It's time for governments to start dropping the hammer on very preventable data breaches

I asked Ian Thornton-Trump, CISO at Cyjax and co-host of the BeerConOne virtual security conference, for his thoughts about this incident. "This is massive, and not unexpected to be honest," he said, "it just shows how difficult it is for anyone, even a giant tech company, to manage data and storage correctly."

Given that there has already been interest from European data protection agencies regarding how Microsoft collects data from Windows 10 users, it wouldn't surprise me if there are now further investigations with a view to EU General Data Protection Regulation (GDPR) penalties. "It kind of demoralizes my soul when even the vendor can't seem to get it right," Thornton-Trump says, "and why the vendor is storing such ancient records in the first place? I think it's time for governments to start dropping the hammer on these very preventable data breaches."

What positives can other organizations take away from this incident?

It's known that this exposure came about as a result of misconfigured security rules on the server holding the Microsoft customer services and support data. The question is, then, how can other organizations avoid finding themselves in a similar sticky security situation? "It's a common mistake in any environment where data is stored," Bischoff says, "security groups set firewall rules that decide who can access what from where (or what device)." However, all of those aspects need to be audited on a regular basis, "to ensure security groups work as intended," according to Bischoff. If they don't, then Bischoff advises that there should be some mechanism in place that detects misconfigurations. "If a misconfiguration is detected," he says, "security staff should be notified immediately so it can be remedied."

-
Updated January 22, 2020 This article was updated to include comments from, and a link to, a Microsoft statement Updated January 23, 2020 This article was updated with advice for organizations to avoid similar issues
... Read More

# data[].attributes.attachment_link.title
Microsoft Security Shocker As 250 Million Customer Records Exposed Online

# data[].attributes.attachment_link.description
A new report reveals that 250 million Microsoft customer records, spanning 14 years, have been exposed online without password protection. Microsoft has been in the news for, mostly, the wrong reasons recently. There is the Internet Explorer zero-day vulnerability that Microsoft hasn't issued a patch for, despite it being actively exploited.

# data[].attributes.body
62102884 Nutchanon Thawornnuruk

# data[].attributes.attachment_link.readable_text
And many, if not all, of these top streamers are effectively large-scale media operations, with their own employees and business expenses - so the numbers do not represent "take-home pay" for those listed, even if genuine.

# data[].attributes.attachment_link.title
Twitch reportedly suffers massive data leak

# data[].attributes.attachment_link.description
And many, if not all, of these top streamers are effectively large-scale media operations, with their own employees and business expenses - so the numbers do not represent "take-home pay" for those listed, even if genuine.

# data[].attributes.headline
Data leak makes Peloton’s Horrible, No-Good, Really Bad Day even worse

# data[].attributes.subject
Data leak makes Peloton’s Horrible, No-Good, Really Bad Day even worse

# data[].attributes.body
62104500 Noppamart Manyu

# data[].attributes.attachment_link.readable_text
Peloton is having a rough day. First, the company recalled two treadmill models following the death of a 6-year-old child who was pulled under one of the devices. Now comes word Peloton exposed sensitive user data, even after the company knew about the leak. No wonder the company's stock price closed down 15 percent on Wednesday.

Peloton provides a line of network-connected stationary bikes and treadmills. The company also offers an online service that allows users to join classes, work with trainers, or do workouts with other users. In October, Peloton told investors it had a community of 3 million members. Members can set accounts to be public so friends can view details such as classes attended and workout stats, or users can choose for profiles to be private.

I know where you worked out last summer

Researchers at security consultancy Pen Test Partners on Wednesday reported that a flaw in Peloton's online service was making data for all of its users available to anyone anywhere in the world, even when a profile was set to private. All that was required was a little knowledge of the faulty programming interfaces that Peloton uses to transmit data between devices and the company's servers.

Data exposed included:

User IDs

Instructor IDs

Group Membership

Workout stats

Gender and age

Weight

If they are in the studio or not

Ars agreed to withhold another piece of personal data exposed because Peloton is still working to secure it.

A blog post Pen Test Partners published on Wednesday said that the APIs required no authentication before providing the information. Company researchers said that they reported the exposure to Peloton in January and promptly received an acknowledgement. Then, Wednesday's post said, Peloton went silent.

Slow response, botched fix

Two weeks later, the researchers said, the company silently provided a partial fix. Rather than providing the user data with no authentication required at all, the APIs made the data available only to those who had an account. The change was better than nothing, but it still let anyone who subscribed to the online service obtain private details of any other subscriber.

When Pen Test Partners informed Peloton of the inadequate fix, they say they got no response. Pen Test Partners researcher Ken Munro said he went as far as looking up company executives on LinkedIn. The researchers said the fix came only after TechCrunch reporter Zack Whittaker, who first reported the leak, inquired about it.

"I was pretty pissed by this point, but figured it was worth one last shot before dropping an 0-day on Peloton users," Munro told me. "I asked Zack W to hit up their press office. That had a miraculous effect - within hours I had an email from their new CISO, who was new in post and had investigated, found their rather weak response and had a plan to fix the bugs."

A Peloton representative declined to discuss the timeline on the record but did provide the following canned response:

It's a priority for Peloton to keep our platform secure and we're always looking to improve our approach and process for working with the external security community. Through our Coordinated Vulnerability Disclosure program, a security researcher informed us that he was able to access our API and see information that's available on a Peloton profile. We took action and addressed the issues based on his initial submissions, but we were slow to update the researcher about our remediation efforts. Going forward, we will do better to work collaboratively with the security research community and respond more promptly when vulnerabilities are reported. We want to thank Ken Munro for submitting his reports through our CVD program and for being open to working with us to resolve these issues.

The incident is the latest reminder that data stored online is often free for the taking, even when companies say it isn't. This puts people in a bind. On the one hand, sharing weight, workout stats, and other data can often help users get the most out of training sessions or group workouts. On the other... well, you know.

I generally try to falsify, or leave incomplete much of the data I provide. Most of the services I use that require a credit card will approve purchases just fine even when I supply a false name, address, and phone number. Not having those details attached to user names or other data can often minimize the sting of a data leak like this one.

Update: I wasn't clear in the last paragraph, so I'll try again. Sites generally have two places where they ask for your information. One set is stored with the user account details. The other is used by the billing processor. My Amazon account, for instance, lists my name as Dang. But when I provided my credit card details, I obviously didn't provide a false name.

The same goes for HBO Max. There's a tab for account info, and there's a tab for billing info. I see no reason why I should enter my real or full name in the account tab. For obvious reasons, I don't falsify info in the billing tab. That said, I can often get away with providing incomplete info when providing billing info. For instance, the billing section of many sites allows me to provide only my street name but not my house number, and only the initials of my first and last name.

My rationale for all of this: Sites generally store account data and billing data in separate buckets, and the bucket holding the billing data seems to be better secured. Internet companies have a terrible track record of securing user data. The less they have about me the better. I'm hoping these additional details better explain how and why I do this.

# data[].attributes.attachment_link.title
Data leak makes Peloton's Horrible, No-Good, Really Bad Day even worse

# data[].attributes.attachment_link.description
Peloton is having a rough day. First, the company recalled two treadmill models following the death of a 6-year-old child who was pulled under one of the devices. Now comes word Peloton exposed sensitive user data, even after the company knew about the leak. No wonder the company's stock price closed down 15 percent on Wednesday.

# data[].attributes.headline
Amazon Fake Reviews Scam Exposed in Data Breach

# data[].attributes.subject
Amazon Fake Reviews Scam Exposed in Data Breach

# data[].attributes.body
62103973 Thanathorn Jeadahoa

# data[].attributes.attachment_link.readable_text
SafetyDetectives Cybersecurity Team

The SafetyDetectives cybersecurity team uncovered an open ElasticSearch database exposing an organized fake reviews scam affecting Amazon.

The server contained a treasure trove of direct messages between Amazon vendors and customers willing to provide fake reviews in exchange for free products. In total, 13,124,962 of these records (or 7 GB of data) have been exposed in the breach, potentially implicating more than 200,000 people in unethical activities.

While it is unclear who owns the database, the breach demonstrates the inner workings of a prevalent issue affecting the online retail industry.

How the Process Works

The information found on the open ElasticSearch server outlines a common procedure by which Amazon vendors procure 'fake reviews' for their products.

These Amazon vendors send to reviewers a list of items/products for which they would like a 5-star review. The people providing the 'fake reviews' will then buy the products, leaving a 5-star review on Amazon a few days after receiving their merchandise.

Upon completion, the provider of the fake review will send a message to the vendor containing a link to their Amazon profile, along with their PayPal details.

Once the Amazon vendor confirms all reviews have been completed, the reviewer will receive a refund through PayPal, keeping the items they bought for free as a form of payment.

The refund for any purchased goods is actioned through PayPal and not directly through Amazon's platform. This makes the five-star review look legitimate, so as not to arouse suspicion from Amazon moderators.

In some cases, there may be an additional payment - based on the scale of the services provided by the person posting fake reviews. However, we didn't find any examples of this in the exposed server.

What was Leaked?

More than 13 million records, equating to 7 GB of data, were exposed when the unclaimed ElasticSearch server was left open without any password protection or encryption. The personal data of people providing fake reviews, as well as Amazon vendors, could be found in leaked messages on the database.

1. Data related to the vendors

These messages contained various examples of contact details from the vendors:

Email addresses

WhatsApp and Telegram phone numbers

Contact details were given to the potential fake review providers to continue communications outside of the services where these leaked interactions had taken place.

2. Data related to the reviewers

Messages on the ElasticSearch server also contained other forms of directly and indirectly identifiable personal data exposing the reviewers themselves, such as:

75K links to Amazon accounts/profiles of review sellers

PayPal account details (email addresses)

Email addresses

'Fan names' - supposedly usernames, often containing names & surnames

Leaked PayPal account details and 'fan names' outline email addresses and what seems to be the usernames of people providing fake reviews. These details could be used to indirectly identify individuals, while many of them contained full names and surnames.

The Gmail addresses of reviewers were also provided to vendors directly via message. In total, 232,664 Gmail addresses have been exposed on the server, though some of the email addresses were duplicates.

The 'Gmail' figure covers only those individuals who use Google as their mail provider. When we factor in the presence of other types of email accounts, such as Outlook, the enormity of this breach becomes apparent. 75,000 Amazon accounts were leaked as well, although there are potentially several duplicates included in this figure. Along with Amazon vendors compromised through their contact details, it's reasonable to estimate that around 200,000-250,000 people were affected by this breach.

The server appeared to be located in China, and it is thought the leak affected citizens from Europe and the USA (at a minimum). In reality, the leak could have affected individuals from all corners of the world.
*Records that were unrelated to messages between vendors and reviewers were written in Chinese, which is why we assume the owners of the server were located in China.
The SafetyDetectives cybersecurity team discovered the breach on March 1st, 2021. We monitored the status of the open ElasticSearch server over the following days, and on March 6th, 2021, the unclaimed database was secured.

We were unable to identify the owner of the ElasticSearch server. As a result, we could not notify the company in question regarding this security issue. Nonetheless, the server was secured a few days later, making it inaccessible to outside parties.

Given the extent of the records and vendors included in the database, it's possible that the server is not owned by the Amazon vendors running the scam. The server could be owned by a third party that reaches out to potential reviewers on behalf of the vendors. Third-parties might post a picture of the product in a Facebook or WeChat group, asking for reviews in return for free products.

The server could also be owned by a large company with several subsidiaries, which would explain the presence of multiple vendors.

What's clear is that whoever owns the server could be subject to punishments from consumer protection laws, and whoever is paying for these fake reviews may face sanctions for breaking Amazon's terms of service.

Avoiding Detection

Amazon vendors running this type of 'fake review scam' are able to avoid detection from Amazon's review moderation team.

Implicated vendors can avoid detection across multiple platforms, too. This is a big reason why online marketplaces are struggling to contain the issue of 'fake reviews', which is now widespread across the entire industry.

Messages in the unclaimed ElasticSearch server highlighted techniques that are employed by businesses to cover their tracks.

Fraudulent businesses give reviewers specific criteria to follow to avoid detection on Amazon. These criteria are designed to present the reviews as legitimate. In this ElasticSearch server, vendors asked reviewers to wait a few days before publishing a review. They also request substantial reviews that are longer than just a few words, and they may even outline certain details that should be included in the review.

Instructions were sent to reviewers to make the reviews more credible.

Vendors often conduct their communications through direct messaging apps. In the ElasticSearch server we discovered, vendors attempted to hide keywords with similar phrases that bypass keyword searches.

This could imply that the platforms used to liaise with potential reviewers were not intended for this purpose, and vendors are likely attempting to evade detection from security technicians.

We're confident some of these interactions were taking place on Facebook, though it seems communications with potential reviewers occurred across several messaging platforms.

The owners of the database may have used a CRM system to aggregate these different channels of communication onto one easy platform, storing the data on the unclaimed ElasticSearch server. However, this is merely an educated assumption.

Posing as a Genuine Service

Although a lot of people providing fake reviews likely know what they're doing, we must also highlight how vendors don't advertise that fake reviews are illegal.

Unassuming people may have been targeted by Amazon vendors with the offer of free products in return for a review. Vendors use 'professional' language to present the offer as legitimate trade, utilizing phrases like 'testing' and 'free product trials' when they message prospective reviewers. This is certainly the case in the database we detected.

Without knowledge of marketing law, Amazon terms of service, or the wider impact fake reviews can have, some individuals may think nothing of collaborating with an Amazon vendor to conduct a fake review.

When considering those who are implicated in this breach, and the impacts they could face because of this exposure, we should be mindful that some of these reviewers have been misled themselves.

Impacts

The owners of the ElasticSearch server have essentially committed two separate offenses. On one hand, companies and individuals have been connected with the production of misleading marketing materials. On the other hand, a data breach in itself has further damages for the persons/business(es) involved.

Punishments for Fake Reviews

So, what are the wider implications for people giving fake reviews, and the Amazon vendors that pay for these fake reviews?

We can split these impacts into two different types: Corporate punishments and individual punishments.

Corporate Punishments

Businesses or individual vendors that are found to be buying fake reviews for their products could face various penalties and sanctions for this type of transgression.

Firstly, Amazon vendors have broken Amazon's terms of service through buying fake reviews.

Amazon can place a number of sanctions on guilty parties. Vendor accounts can be terminated permanently, and vendors can lose their selling privileges with an immediate effect. Amazon will withhold all earnings from pending transactions - where products have been sold, but earnings have not yet been collected by the vendor.

The reviews will be removed from any product page that is found to contain fake reviews, and that product will not be able to receive reviews or ratings in the future. Products can even be delisted from the site altogether.

Amazon retains the right to disclose the vendor's name (and any other related information) publicly. An exercise that highlights the fraudulent company's wrongdoings to warn those who may have been affected, while causing reputational damage to the business in question.

Amazon's terms of service outline that Amazon may choose to pursue legal action against the business involved.

In several countries, paying people to conduct fake reviews is an illegal practice that damages the rights of consumers. If a company purchasing fake reviews is based in the United States, it would face lawful action from the Federal Trade Commission (FTC). Using deceptive marketing tactics could land a US-based vendor with a heavy penalty of more than $10 million.

Individual Punishments

The breach also means people exposed as 'fake review sellers' may be subject to lawful punishment themselves. Whether individuals are found to be guilty of selling reviews or not would make a huge difference to the consequences they could face. If reviewers are found to have been 'misled', punishments could be vastly reduced and the individuals may only receive a 'slap on the wrist'.

Fraudulent reviewers with thousands of fake reviews to their name can pay penalties of more than $10,000, and they could even receive a jail sentence. The severity of these punishments would depend on whichever jurisdiction is in control of the investigation.

The Amazon accounts of fake reviewers will likely be terminated as well, though Amazon's primary focus is on pursuing guilty vendors rather than investigating each individual reviewer.

Data Breach Impact

The reputational and financial damage provoked by a data breach of this nature is tangible. On top of the above penalties and charges, if the ElasticSearch database owner was to be identified, they could face further sanctions for breaking data protection laws.

All of the jurisdictions involved in such cases are unclear until we know the citizenship of individuals who have had their data leaked. The fraudulent owner of the server seems to be based in China. A serious breach of data protection laws there could land the owner with fines up to $7.6 million (or 5% of the company's turnover from the previous year).

If individuals from other nations are affected, other jurisdictions could also carry out investigations. Any damages to American citizens could involve the FTC, which can fine businesses up to $100 million, while European citizens are protected by GDPR. If the data of European citizens is mishandled, a fine of around €20 million (or 4% of a companies income) could be charged to the owner of the database.

The data breach, along with any additional crimes, will perceivably cause reputational damage to businesses tied to such an event. Future customers may choose to avoid businesses involved in lawsuits, unlawful activities, or poor data protection practices.

The personal information of hundreds of thousands of people can be found on the database, and this puts those individuals in harm's way of hackers and cybercriminals.

It is currently unknown whether hackers accessed the open ElasticSearch server. If hackers have accessed the server, then the emails, names, and surnames of affected reviewers and vendors could be used to target people with scams, phishing attacks, fraud, and even blackmail.

With something as simple as an email address, a hacker could launch a phishing attack. Here they would send a targeted email, using personal data to speak directly to the victim and build an element of trust. The email will attempt to convince a victim to click on a link, either leading to a fake website or downloading malicious files onto that person's computer. These malicious files provide the basis for hackers to conduct further criminal activities, such as fraud and/or identity theft.

Hackers can attempt scams through targeted emails, too, by convincing parties to buy a product or send over details that would facilitate fraudulent attacks. Hackers could build trust by referring to the products reviewers have tested, or they could use PayPal as the focus of their attack.

Hackers could pose as a representative of PayPal, requesting that users 'update their password'. Once users have passed on their PayPal password to the hacker, the hacker will gain access to that person's PayPal account - draining it of funds.

Hackers can pepper leaked PayPal accounts with generated passwords until they gain access. Once into a PayPal account, there's additional personal information that hackers can use to build trust and focus their attacks. For example, transaction history could be used to pose as a representative of another business.

The server contained incriminating information for thousands of people and businesses, information that those parties may not wish to be available to regulatory or investigative authorities. The obvious risk associated with incriminating data means hackers could target victims with blackmail. Once hackers have obtained the data, they could demand huge amounts of money or information from individuals and vendors, with the threat of releasing the incriminating files should the victim fail to comply.

How to Spot Online Fake Reviews

Online 'fake reviews' mislead customers and coerce buyers into purchasing decisions that they otherwise might not make. Fake reviews deny potential buyers a fair and honest assessment of products at the benefit of the vendor involved. Buyers may ultimately be underwhelmed with the product, or feel deceived by the reviews they have read.

Not only do these incidents violate the terms of service on thousands of online marketplaces, but they also break the law in several countries as a violation of 'consumer protection'.

Fake reviewers sell their services to corporations, either in return for free products or in the form of 'packages' where vendors can buy misleading reviews in bulk. These bundles can contain up to 1000 reviews for a price of around $11,000.

Big online marketplaces are failing to contain the issue, and in doing so are failing to ensure the safety of their customers. Sites like Amazon face a struggle to contain a problem that is now widespread, and more must be done to bring down a thriving economy of deception.

The scale and impact of the issue means we should all do what we can to identify fake reviews when we use online marketplaces, like Amazon. Spotting and reporting suspected fake reviews helps protect ourselves and other consumers.

Reporting such incidents could provide crucial support to marketplaces trying to contain the problem. Here's how you can spot an online fake review:

Be skeptical of extreme reviews. The 'perfect' product rarely exists. If a product has a ton of overbearingly positive reviews (especially when compared to similar products), you should question the legitimacy of those reviews. You should also look out for reviews that are 100% positive or 100% negative.

Look for suspicious language. Fake reviews often use less emotional language, and they can be hard to read. A fake review may even read like an advert, badmouthing the product's competitors in the process.

Look for generic statements about the product. Several of the five-star reviews may highlight the same plus points, or the reviews could generally lack variance - not revealing anything about each individual's specific experience. Fake reviews might contain lots of generic keywords, too, or reference the brand's name multiple times.

Fake reviews can be shorter. If a review is just a few words long, the reviewer might be trying to affect the product's star rating as quickly as possible.

Be extra-vigilant when buying from unknown brands. Early start-ups often try to elevate their status with fake reviews. Check for reviews of their products on other sites before buying, and make sure they have legitimate contact details should anything go wrong.

Check for irrelevant information. 'Review merging' is commonplace for guilty vendors, who republish reviews from other products onto their own. Fake reviews could contain other examples of false information, too. Make sure any feedback makes sense for the product it's supposedly reviewing.

Cross-examine five-star reviews with bad ones. Bad reviews might consistently highlight issues that fake five-star reviews don't acknowledge. Fake reviews may even say this characteristic of the product is a positive.

Check the reviewer's account. If they have left positive reviews on loads of the same vendor's products, they could be fake, and the same can be said if they are leaving negative reviews. If their account lacks personal information and their buying habits are random, that's another sign of a fake reviewer.

Check for patterns. A negative review could be followed by a cluster of fake five-star reviews. Also, a number of the reviews might sound similar, or a fake reviewer might post similar reviews on multiple products.

Check the dates of reviews. If a product's five-star reviews have been posted before the product was listed, or over a short time-span, they could well be fake.

Use software. There are loads of good online tools that will analyze a product's reviews and tell you if they seem fake. Use them!

You can report a fake review whenever you have your suspicions. Most online marketplaces have a symbol of a flag or an exclamation mark next to each comment. On Amazon, there is a 'report' button. Clicking this will take you through the referral process.

Preventing Data Exposure

If you're worried about your data, there are a few immediate steps you should take to mitigate your risk of exposure and minimize the impact of cybercrime:

Only give your data to companies/individuals you know or can completely trust.

Make sure the website you're on is secure. Secure website domains have a 'https' and/or a closed lock symbol at the beginning.

Do not give out information that can easily be used against you (government ID numbers and personal preferences should be kept to yourself).

Use letters, numbers, and symbols to create rock-solid passwords.

Don't click links in emails (or anywhere online) that you cannot be sure are from a reputable source.

Make sure your privacy settings on social media sites only show your content and personal information to trusted people.

Avoid using credit cards or typing out passwords on unsecured Wi-Fi networks.

Educate yourself on data protection, cybercrime, and the different ways you can avoid phishing attacks and ransomware.

About us

SafetyDetectives.com is the world's largest cybersecurity review website.

The SafetyDetectives research lab is a pro bono service that aims to help the online community defend itself against cyber threats while educating organizations on how to protect their users' data. The overarching purpose of our web mapping project is to help make the internet a safer place for all users.

Our previous reports have brought multiple high-profile vulnerabilities and data leaks to light, including the 200+ million users exposed by Chinese social media management company Socialarks as well as a breach at major cosmetics brand Avon that leaked more than 7 GB of data.

For a full review of SafetyDetectives cybersecurity reporting over the past 3 years, follow SafetyDetectives Cybersecurity Team.

Published on: May 6, 2021

# data[].attributes.attachment_link.title
Amazon Fake Reviews Scam Exposed in Data Breach

# data[].attributes.attachment_link.description
SafetyDetectives Cybersecurity Team The SafetyDetectives cybersecurity team uncovered an open ElasticSearch database exposing an organized fake reviews scam affecting Amazon. The server contained a treasure trove of direct messages between Amazon vendors and customers willing to provide fake reviews in exchange for free products.

# data[].attributes.headline
DigitalOcean says customer billing data accessed in data breach

# data[].attributes.subject
DigitalOcean says customer billing data accessed in data breach

# data[].attributes.body
62116397 Pakanan Nudam

# data[].attributes.attachment_link.readable_text
DigitalOcean has emailed customers warning of a data breach involving customers' billing data, TechCrunch has learned.

The cloud infrastructure giant told customers in an email on Wednesday, obtained by TechCrunch, that it has "confirmed an unauthorized exposure of details associated with the billing profile on your DigitalOcean account." The company said the person "gained access to some of your billing account details through a flaw that has been fixed" over a two-week window between April 9 and April 22.

The email said customer billing names and addresses were accessed, as well as the last four digits of the payment card, its expiry date and the name of the card-issuing bank. The company said that customers' DigitalOcean accounts were "not accessed," and passwords and account tokens were "not involved" in this breach.

"To be extra careful, we have implemented additional security monitoring on your account. We are expanding our security measures to reduce the likelihood of this kind of flaw occuring [sic] in the future," the email said.

DigitalOcean said it fixed the flaw and notified data protection authorities, but it's not clear what the apparent flaw was that put customer billing information at risk.

In a statement, DigitalOcean's security chief Tyler Healy said 1% of billing profiles were affected by the breach, but declined to address our specific questions, including how the vulnerability was discovered and which authorities have been informed.

Companies with customers in Europe are subject to GDPR and can face fines of up to 4% of their global annual revenue.

Last year, the cloud company raised $100 million in new debt, followed by another $50 million round, months after laying off dozens of staff amid concerns about the company's financial health. In March, the company went public, raising about $775 million in its initial public offering.

# data[].attributes.attachment_link.title
DigitalOcean says customer billing data accessed in data breach

# data[].attributes.attachment_link.description
DigitalOcean has emailed customers warning of a data breach involving customers' billing data, TechCrunch has learned. The cloud infrastructure giant told customers in an email on Wednesday, obtained by TechCrunch, that it has "confirmed an unauthorized exposure of details associated with the billing profile on your DigitalOcean account."

# data[].attributes.headline
Experian challenged over massive data leak in Brazil

# data[].attributes.subject
Experian challenged over massive data leak in Brazil

# data[].attributes.body
62100268 Korawich

# data[].attributes.attachment_link.readable_text
After receiving feedback from Experian over a massive data leak in Brazil, São Paulo state consumer rights foundation Procon described the company's explanations as "insufficient" and said it is likely that the incident was initiated in a corporate environment.

Procon notified the credit information multinational following the emergence of a leak that exposed the personal data of more than 220 million citizens as well as companies, currently offered for sale in the dark web. Security firm PSafe discovered the incident, which exposed all manner of personal details, including information from Mosaic, a consumer segmentation model used by Serasa, Experian's Brazilian subsidiary.

Following the emergence of the leak in January, Procon notified the credit bureau, and asked the company for a confirmation of the incident, and an explanation of the reasons that caused the leak, the steps taken to contain it, how it will repair the damage to consumers impacted and the measures taken to prevent it from happening again.

"No hypothesis has been ruled out, and at the moment we consider it is more likely that the leak came from inside companies rather than hackers," said Procon's executive director Fernando Capez, adding that Experian's feedback prompts more questions than answers. The explanations from the company will be analyzed by the board of the consumer rights body, and a fine may be applicable if any wrongdoing becomes evident.

According to Procon, Experian informed that all its activities that involve personal data comply with the Brazilian data protection regulations, and that processing of such data can legally serve several purposes. That part of the answer was insufficient, the consumer rights body said, since "there is no legal basis for the treatment and use of data in an indiscriminate manner" and that includes data of deceased individuals, also exposed in the leak.

In addition, Procon noted that Serasa Experian did not specify the technical and organizational measures adopted to implement its data protection policy. Moreover, the company reinforced what it had said in a statement released last week in its response to the notification, that there is no evidence that credit data has been illegally obtained from its Brazilian subsidiary. The company also argued that there is no evidence that its technology systems had been compromised.

In relation to Serasa Experian's risk mitigation policy that may occur in such circumstances, Procon said the company only stated that a "comprehensive information security program" is currently in place. Regarding damage repair to consumers, Serasa Experian stated that its website has instructions on what to do in case of fraud. Procon's stance is that this is a preventive measure rather than a reparative action.

Contacted by ZDNet, Serasa Experian did not answer to requests for comment on Procon's response to its feedback. The agency's demands for answers follow calls from the Brazilian Institute for Consumer Protection (IDEC) for urgent measures to investigate and punish those responsible for exposing the population's data, as well as improved citizen information and transparency.

# data[].attributes.attachment_link.title
Experian challenged over massive data leak in Brazil | ZDNet

# data[].attributes.attachment_link.description
After receiving feedback from Experian over a massive data leak in Brazil, São Paulo state consumer rights foundation Procon described the company's explanations as "insufficient" and said it is likely that the incident was initiated in a corporate environment.

# data[].attributes.headline
T-Mobile: Breach Exposed SSN/DOB of 40M+ People

# data[].attributes.subject
T-Mobile: Breach Exposed SSN/DOB of 40M+ People

# data[].attributes.body
62101001 Kewalee Sittisomboon

# data[].attributes.attachment_link.readable_text
T-Mobile is warning that a data breach has exposed the names, date of birth, Social Security number and driver's license/ID information of more than 40 million current, former or prospective customers who applied for credit with the company. The acknowledgment came less than 48 hours after millions of the stolen T-Mobile customer records went up for sale in the cybercrime underground.

In a statement Tuesday evening, T-Mobile said a "highly sophisticated" attack against its network led to the breach of data on millions of customers.

"Our preliminary analysis is that approximately 7.8 million current T-Mobile postpaid customer accounts' information appears to be contained in the stolen files, as well as just over 40 million records of former or prospective customers who had previously applied for credit with T-Mobile," the company wrote in a blog post. "Importantly, no phone numbers, account numbers, PINs, passwords, or financial information were compromised in any of these files of customers or prospective customers."

Nevertheless, T-Mobile is urging all T-Mobile postpaid customers to proactively change their account PINs by going online into their T-Mobile account or calling customer care at 611. "This precaution is despite the fact that we have no knowledge that any postpaid account PINs were compromised," the advisory reads.

It is not clear how many people total may be impacted by this breach. T-Mobile hasn't yet responded to requests for clarification regarding how many of the 7.8 million current customers may also have been affected by the credit application breach.

The intrusion first came to light on Twitter when the account @und0xxed started tweeting the details, and someone on a cybercrime forum began selling what they claimed were more than 100 million freshly hacked records from T-Mobile. The hackers claimed one of those databases held the name, date of birth, SSN, drivers license information, plaintext security PIN, address and phone number of 36 million T-Mobile customers in the United States - all going back to the mid-1990s.

T-Mobile said it was also able to confirm approximately 850,000 active T-Mobile prepaid customer names, phone numbers and account PINs were also exposed.

"We have already proactively reset ALL of the PINs on these accounts to help protect these customers, and we will be notifying accordingly right away. No Metro by T-Mobile, former Sprint prepaid, or Boost customers had their names or PINs exposed," T-Mobile said. "We have also confirmed that there was some additional information from inactive prepaid accounts accessed through prepaid billing files. No customer financial information, credit card information, debit or other payment information or SSN was in this inactive file."

T-Mobile said it would pay for two years of identity theft protection services for any affected customers, and that it was offering "an extra step to protect your mobile account with our Account Takeover Protection capabilities for postpaid customers, which makes it harder for customer accounts to be fraudulently ported out and stolen." Why it wouldn't make that extra protection standard for all accounts all the time is not entirely clear.

This stolen data is being actively sold, but if the past is any teacher much of it will wind up posted online soon. It is a safe bet that scammers will use some of this information to target T-Mobile users with phishing messages, account takeovers and harassment.

T-Mobile customers should expect to see phishers taking advantage of public concern over the breach to impersonate the company - and possibly even messages that include the recipient's compromised account details to make the communications look more legitimate.

Data stolen and exposed in this breach may also be used for identity theft. Credit monitoring and ID theft protection services can help you recover from having your identity stolen, but most will do nothing to stop the ID theft from happening. If you want the maximum control over who should be able to view your credit or grant new lines of credit in your name, then a security freeze is your best option.

If you're a current T-Mobile customer, by all means change your account PIN as instructed. But regardless of which mobile provider you patronize, consider removing your phone number from as many online accounts as you can. Many online services require you to provide a phone number upon registering an account, but in many cases that number can be removed from your profile afterwards.

Why do I suggest this? Many online services allow users to reset their passwords just by clicking a link sent via SMS, and this unfortunately widespread practice has turned mobile phone numbers into de facto identity documents. Which means losing control over your phone number thanks to an unauthorized SIM swap or mobile number port-out, divorce, job termination or financial crisis can be devastating.

# data[].attributes.attachment_link.title
T-Mobile: Breach Exposed SSN/DOB of 40M+ People

# data[].attributes.attachment_link.description
T-Mobile is warning that a data breach has exposed the names, date of birth, Social Security number and driver's license/ID information of more than 40 million current, former or prospective customers who applied for credit with the company. The acknowledgment came less than 48 hours after millions of the stolen T-Mobile customer records went up for sale in the cybercrime underground.

# data[].attributes.headline
Australian tech unicorn Canva suffers security breach | ZDNet

# data[].attributes.subject
Australian tech unicorn Canva suffers security breach | ZDNet

# data[].attributes.body
62100359 Kritsanaphong Kimsue

# data[].attributes.attachment_link.title
Australian tech unicorn Canva suffers security breach | ZDNet

# data[].attributes.attachment_link.description
Hacker claims to have stolen the data of 139 million Canva users.

# data[].attributes.headline
Details of some 100 million visitors to Thailand exposed online: research firm

# data[].attributes.subject
Details of some 100 million visitors to Thailand exposed online: research firm

# data[].attributes.body
62105960 Parichat Chusit

# data[].attributes.attachment_link.title
Details of 100 million travellers to Thailand exposed online: report

# data[].attributes.attachment_link.description
British firm Comparitech said any foreigner who has travelled to Thailand in the last decade ‘might have had their information exposed’.

# data[].attributes.body
https://informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

# data[].attributes.attachment_link.title
World's Biggest Data Breaches & Hacks - Information is Beautiful

# data[].attributes.attachment_link.description
Data visualization of the world biggest data breaches, leaks and hacks. Constantly updated. Powered by @VizSweet.

# data[].attributes.headline
38M Records Were Exposed Online—Including Contact-Tracing Info

# data[].attributes.subject
38M Records Were Exposed Online—Including Contact-Tracing Info

# data[].attributes.body
62101696 Jesadapan Pongseng

# data[].attributes.attachment_link.title
38M Records Were Exposed Online—Including Contact-Tracing Info

# data[].attributes.attachment_link.description
Misconfigured Power Apps from Microsoft led to more than a thousand web apps accessible to anyone who found them.

# data[].attributes.headline
Pandora papers: biggest ever leak of offshore data exposes financial secrets of rich and powerful

# data[].attributes.subject
Pandora papers: biggest ever leak of offshore data exposes financial secrets of rich and powerful

# data[].attributes.body
Pandora papers: biggest ever leak of offshore data exposes financial secrets of rich and powerful | World news | The Guardian
62115340 SURIN HAWAE

# data[].attributes.attachment_link.readable_text
The secret deals and hidden assets of some of the world's richest and most powerful people have been revealed in the biggest trove of leaked offshore data in history.

Branded the Pandora papers, the cache includes 11.9m files from companies hired by wealthy clients to create offshore structures and trusts in tax havens such as Panama, Dubai, Monaco, Switzerland and the Cayman Islands.

They expose the secret offshore affairs of 35 world leaders, including current and former presidents, prime ministers and heads of state. They also shine a light on the secret finances of more than 300 other public officials such as government ministers, judges, mayors and military generals in more than 90 countries.

The files include disclosures about major donors to the Conservative party, raising difficult questions for Boris Johnson as his party meets for its annual conference.

More than 100 billionaires feature in the leaked data, as well as celebrities, rock stars and business leaders. Many use shell companies to hold luxury items such as property and yachts, as well as incognito bank accounts. There is even art ranging from looted Cambodian antiquities to paintings by Picasso and murals by Banksy.

The Pandora papers reveal the inner workings of what is a shadow financial world, providing a rare window into the hidden operations of a global offshore economy that enables some of the world's richest people to hide their wealth and in some cases pay little or no tax.

The Pandora papers are the largest trove of leaked data exposing tax haven secrecy in history. They provide a rare window into the hidden world of offshore finance, casting light on the financial secrets of some of the world's richest people. The files were leaked to the International Consortium of Investigative Journalists (ICIJ), which shared access with the Guardian, BBC and other media outlets around the world. In total, the trove consists of 11.9m files leaked from a total of 14 offshore service providers, totalling 2.94 terabytes of information. That makes it larger in volume than both the Panama papers (2016) and Paradise papers (2017), two previous offshore leaks.
Where did the Pandora documents come from?
The ICIJ, a Washington DC-based journalism nonprofit, is not identifying the source of the leaked documents. In order to facilitate a global investigation, the ICIJ gave remote access to the documents to journalists in 117 countries, including reporters at the Washington Post, Le Monde, El País, Süddeutsche Zeitung, PBS Frontline and the Australian Broadcasting Corporation. In the UK, the investigation has been led by the Guardian and BBC Panorama.
What is an offshore service provider?
The 14 offshore service providers in the leak provide corporate services to individuals or companies seeking to do business offshore. Their clients are typically seeking to discreetly set up companies or trusts in lightly regulated tax havens such as the British Virgin Islands (BVI), Panama, the Cook Islands and the US state of South Dakota. Companies registered offshore can be used to hold assets such as property, aircraft, yachts and investments in stocks and shares. By holding those assets in an offshore company, it is possible to hide from the rest of the world the identity of the person they actually belong to, or the "beneficial owner".
Why do people move money offshore?
Usually for reasons of tax, secrecy or regulation. Offshore jurisdictions tend to have no income or corporation taxes, which makes them potentially attractive to wealthy individuals and companies who don't want to pay taxes in their home countries. Although morally questionable, this kind of tax avoidance can be legal. Offshore jurisdictions also tend to be highly secretive and publish little or no information about the companies or trusts incorporated there. This can make them useful to criminals, such as tax evaders or money launderers, who need to hide money from tax or law enforcement authorities. It is also true that people in corrupt or unstable countries may use offshore providers to put their assets beyond the reach of repressive governments or criminal adversaries who may try to seize them, or to seek to circumvent hard currency restrictions. Others may go offshore for reasons of inheritance or estate planning.
Has everyone named in the Pandora papers done something wrong?
No. Moving money offshore is not in or of itself illegal, and there are legitimate reasons why some people do it. Not everyone named in the Pandora papers is suspected of wrongdoing. Those who are may stand accused of a wide range of misbehaviour: from the morally questionable through to the potentially criminal. The Guardian is only publishing stories based on leaked documents after considering the public interest. That is a broad concept that may include furthering transparency by revealing the secret offshore owners of UK property, even where those owners have done nothing wrong. Other articles might illuminate issues of important public debate, raise moral questions, shed light on how the offshore industry operates, or help inform voters about politicians or donors in the interests of democratic accountability.

Thank you for your feedback.

There are emails, memos, incorporation records, share certificates, compliance reports and complex diagrams showing labyrinthine corporate structures. Often, they allow the true owners of opaque shell companies to be identified for the first time.

The files were leaked to the International Consortium of Investigative Journalists (ICIJ) in Washington. It shared access to the leaked data with select media partners including the Guardian, BBC Panorama, Le Monde and the Washington Post. More than 600 journalists have sifted through the files as part of a massive global investigation.

The Pandora papers represent the latest - and largest in terms of data volume - in a series of major leaks of financial data that have convulsed the offshore world since 2013.

Setting up or benefiting from offshore entities is not itself illegal, and in some cases people may have legitimate reasons, such as security, for doing so. But the secrecy offered by tax havens has at times proven attractive to tax evaders, fraudsters and money launderers, some of whom are exposed in the files.

Other wealthy individuals and companies stash their assets offshore to avoid paying tax elsewhere, a legal activity estimated to cost governments billions in lost revenues.

After more than 18 months analysing the data in the public interest, the Guardian and other media outlets will publish their findings over the coming days, beginning with revelations about the offshore financial affairs of some of the most powerful political leaders in the world.

They include the ruler of Jordan, King Abdullah II, who, leaked documents reveal, has amassed a secret $100m property empire spanning Malibu, Washington and London. The king declined to answer specific questions but said there would be nothing improper about him owning properties via offshore companies. Jordan appeared to have blocked the ICIJ website on Sunday, hours before the Pandora papers launched.

The files also show that Azerbaijan's ruling Aliyev family has traded close to £400m of UK property in recent years. One of their properties was sold to the Queen's crown estate, which is now looking into how it came to pay £67m to a company that operated as a front for the family that runs a country routinely accused of corruption. The Aliyevs declined to comment.

The Pandora papers also threaten to cause political upsets for two European Union leaders. The prime minister of the Czech republic, Andrej Babiš, who is up for election this week, is facing questions over why he used an offshore investment company to acquire a $22m chateau in the south of France. He too declined to comment.

And in Cyprus, itself a controversial offshore centre, the president, Nicos Anastasiades, may be asked to explain why a law firm he founded was accused of hiding the assets of a controversial Russian billionaire behind fake company owners. The firm denies any wrongdoing, while the Cypriot president says he ceased having an active role in its affairs after becoming leader of the opposition in 1997.

Not everyone named in the Pandora papers is accused of wrongdoing. The leaked files reveals that Tony and Cherie Blair saved £312,000 in property taxes when they purchased a London building partially owned by the family of a prominent Bahraini minister.

The former prime minister and his wife bought the £6.5m office in Marylebone by acquiring a British Virgin Islands (BVI) offshore company. While the move was not illegal, and there is no evidence the Blairs proactively sought to avoid property taxes, the deal highlights a loophole that has enabled wealthy property owners not to pay a tax that is commonplace for ordinary Britons.

The leaked records vividly illustrate the central coordinating role London plays in the murky offshore world. The UK capital is home to wealth managers, law firms, company formation agents and accountants. All exist to serve their ultra-rich clients. Many are foreign-born tycoons who enjoy "non-domicile" status, which means they pay no tax on their overseas assets.

Ukraine's president, Volodymyr Zelenskiy, who was elected in 2019 on a pledge to clean up his country's notoriously corrupt and oligarch-influenced economy, is also named in the leak. During the campaign, Zelenskiy transferred his 25% stake in an offshore company to a close friend who now works as the president's top adviser, the files suggest. Zelenskiy declined to comment and it is unclear if he remains a beneficiary.

The Russian president, Vladimir Putin, whom the US suspects of having a secret fortune, does not appear in the files by name. But numerous close associates do, including his best friend from childhood - the late Petr Kolbin - whom critics have called a "wallet" for Putin's own wealth, and a woman the Russian leader was allegedly once romantically involved with. None responded to invitations to comment.

The Pandora papers also place a revealing spotlight on the offshore system itself. In a development likely to prove embarrassing for the US president, Joe Biden, who has pledged tolead efforts internationally to bring transparency to the global financial system, the US emerges from the leak as a leading tax haven. The files suggest the state of South Dakota, in particular, is sheltering billions of dollars in wealth linked to individuals previously accused of serious financial crimes.

The offshore trail also stretches from Africa to Latin America to Asia, and is likely to pose difficult questions for politicians across the world. In Pakistan, Moonis Elahi, a prominent minister in prime minister Imran Khan's government, contacted an offshore provider in Singapore about investing $33.7m.

In Kenya, the president, Uhuru Kenyatta, has portrayed himself as an enemy of corruption. In 2018, Kenyatta told the BBC: "Every public servant's assets must be declared publicly so that people can question and ask: what is legitimate?"

He will come under pressure to explain why he and his close relatives amassed more than $30m of offshore wealth, including property in London. Kenyatta did not respond to enquiries about whether his family wealth was declared to relevant authorities in Kenya.

The Pandora papers also reveal some of the unseen repercussions of previous offshore leaks, which spurred modest reforms in some parts of the world, such as the BVI, which now keeps a record of the real owners of companies registered there. However, the newly leaked data shows money shifting around offshore destinations, as wealthy clients and their advisers adjust to new realities.

Some clients of Mossack Fonseca, the now defunct law firm at the heart of the 2016 Panama papers disclosures, simply transferred their companies to rival providers such as another global trust and corporate administrator with a major office in London, whose data is in the new trove of leaked files.

Asked why he was migrating the new company, one customer wrote bluntly: "Business decision to exit following the Panama papers." Another agent said the industry had always "adapted" to external pressure.

Some leaked files appear to show some in the industry seeking to circumvent new privacy regulations. One Swiss lawyer refused to email the names of his high-value customers to a service provider in the BVI, following new legislation. Instead, he sent them by airmail, with strict instructions they should not be processed in any "electronic way". The identity of another beneficial owner was shared via WhatsApp.

"The purpose of this way to proceed is to enable you to comply with BVI rules," the lawyer wrote. Referring to Mossack Fonseca, the lawyer added: "You are obliged to keep secrecy for our clients and to not make feasible at all a second 'Panama papers' story that happened to one of your competitors."

Gerard Ryle, the director of the ICIJ, said leading politicians who organised their finances in tax havens had a stake in the status quo, and were likely to be an obstacle to reform of the offshore economy. "When you have world leaders, when you have politicians, when you have public officials, all using the secrecy and all using this world, then I don't think we're going to see an end to it."

Do you have information about this story? Email investigations@theguardian.com, or use Signal or WhatsApp to message (UK) +44 7584 640566 or (US) +1 646 886 8761

He expected the Pandora papers to have a greater impact than previous leaks, not least because they were arriving in the middle of a pandemic that had exacerbated inequalities and forced governments to borrow unprecedented amounts to be shouldered by ordinary taxpayers. "This is the Panama papers on steroids," Ryle said. "It's broader, richer and has more detail."

At least $11.3tn in wealth is held offshore, according to a 2020 study by the Paris-based Organisation for Economic Co-operation and Development (OECD). "This is money that is being lost to treasuries around the world and money that could be used to recover from Covid," Ryle said. "We're losing out because some people are gaining. It's as simple as that. It's a very simple transaction that's going on here."
Pandora papers reporting team: Simon Goodley, Harry Davies, Luke Harding, Juliette Garside, David Conn, David Pegg, Paul Lewis, Caelainn Barr, Rowena Mason, Joseph Smith and Pamela Duncan in London; Ben Butler and Anne Davies in Sydney; Dominic Rushe in New York; Andrew Roth in Moscow; Helena Smith in Athens; Michael Safi in Lebanon; Robert Tait in Prague.
Support independent investigative Guardian journalism

# data[].attributes.attachment_link.title
Pandora papers: biggest ever leak of offshore data exposes financial secrets of rich and powerful

# data[].attributes.attachment_link.description
The secret deals and hidden assets of some of the world's richest and most powerful people have been revealed in the biggest trove of leaked offshore data in history. Branded the Pandora papers, the cache includes 11.9m files from companies hired by wealthy clients to create offshore structures and trusts in tax havens such as Panama, Dubai, Monaco, Switzerland and the Cayman Islands.

# data[].attributes.headline
Call Of Duty Accounts Hacked? Activision Denies Any Compromise

# data[].attributes.subject
Call Of Duty Accounts Hacked? Activision Denies Any Compromise

# data[].attributes.body
62104310 Theeradon Boonrod

# data[].attributes.attachment_link.readable_text
Possible credential stuffing attack could have affected 500,000 Activision gamer accounts
© 2018 Bloomberg Finance LP

According to reports, more than 500,000 Activision accounts may have been hacked with login data compromised. The eSports site Dexerto has reported that a data breach occurred on Sunday, September 20. The credentials to access these accounts are, Dexerto said, being leaked publicly, and account details changed to prevent easy recovery by the rightful owners. Activision accounts are mostly used by players of the hugely popular Call of Duty franchise. Several eSports and gaming accounts on Twitter have also reported the suspected breach. The first was @Okami, founder of Respawnable, who tweeted, "It's legit," adding that players should change their account passwords immediately.

However, an Activision spokesperson issued the following statement on September 22:

"Activision Call of Duty accounts have not been compromised. Reports suggesting otherwise are not accurate. We investigate all privacy concerns. As always we recommend that players take precautions to protect their accounts at all times. Please visit our player support page for further information, including a helpful set of tips and step-by-step instructions."

Those instructions can be found here.

MORE FROM FORBES Fortnite Hackers Earn $1 Million A Year-Stealing Your Skins

The advice offered by Activision is comprehensive, but missing my normal recommendation that you should also activate two-factor authentication (2FA) to protect an account. The reason being that it appears this isn't an option on Activision accounts.

"Many games require accounts to be created to play online," Javvad Malik, a security awareness advocate at KnowBe4, said, and for many players, this is such a trivial affair that "not much thought is given to security." Which is, of course, why they are, as Malik noted, an appealing target for anyone "looking to compromise large numbers of accounts quickly."

Dean Ferrando, a lead systems engineer (EMEA) at Tripwire, added that such breached accounts provide "a goldmine for malicious actors intending to plan further attacks - be it phishing or otherwise."

While Activision has poured cold water on the suggestion that there is any mass account hacking campaign happening, gamers continue to contact me to say their accounts have, indeed, been hacked. This is, most likely, as a result of credential stuffing involving the use of compromised passwords from other services where the same credentials have also been used. Don't reuse passwords across sites and services, install a password manager and ensure strong and unique passwords for every account.
- Updated September 22 with statement from Activision
Follow me on Twitter or LinkedIn. Check out my website or some of my other work here.

... Read More

# data[].attributes.attachment_link.title
Call Of Duty Accounts Hacked? Activision Denies Any Compromise

# data[].attributes.attachment_link.description
According to reports, more than 500,000 Activision accounts may have been hacked with login data compromised. The eSports site Dexerto has reported that a data breach occurred on Sunday, September 20. The credentials to access these accounts are, Dexerto said, being leaked publicly, and account details changed to prevent easy recovery by the rightful owners.

# data[].attributes.headline
Epik data breach impacts 15 million users, including non-customers

# data[].attributes.subject
Epik data breach impacts 15 million users, including non-customers

# data[].attributes.body
62108394 Laksika Sriboonnark

# data[].attributes.attachment_link.readable_text
Epik has now confirmed that an "unauthorized intrusion" did in fact occur into its systems. The announcement follows last week's incident of hacktivist collective Anonymous leaking 180 GB of data stolen from online service provider Epik. To mock the company's initial response to the data breach claims, Anonymous had altered Epik's official knowledge base, as reported by Ars.

Epik is a domain registrar and web services provider known to serve right-wing clients, some of which have been turned down by more mainstream IT providers due to the objectionable and sometimes illicit content hosted by the clients. Epik's clients have included the Texas GOP, Parler, Gab, and 8chan, among others.

Epik hack impacts millions of non-customers, too

Turns out, the leaked data dump contains 15,003,961 email addresses belonging to both Epik's customers and non-customers, and not everyone is pleased with the news. This occurred as Epik had scraped WHOIS records of domains, even those not owned by the company, and stored these records. In doing so, the contact information of those who have never transacted with Epik directly was also retained in Epik's systems.

Data breach monitoring service HaveIBeenPwned has now begun sending out alerts to their subscribers whose email addresses were exposed in the Epik hack. The service's founder, Troy Hunt, is one of the many impacted by the data breach but who " had absolutely nothing to do with Epik."

In a poll last week, Hunt had asked if affected users who weren't Epik customers preferred receiving breach alerts as well. The majority of users responded affirmatively to the question.

Processing the Epik breach and there's *lots* of email addresses taken from other places, for example stored copies of WHOIS records. If your address is in there - even if you didn't subscribe to the service - do you want @haveibeenpwned to notify you that they have your address?

- Troy Hunt (@troyhunt) September 17, 2021

"The breach exposed a huge volume of data not just of Epik customers, but also scraped WHOIS records belonging to individuals and organisations who were not Epik customers," states HaveIBeenPwned. "The data included over 15 million unique email addresses (including anonymised versions for domain privacy), names, phone numbers, physical addresses, purchases and passwords stored in various formats."

Ars has seen a part of the leaked whois.sql data set file, roughly 16 GB in size, with emails, IP addresses, domains, physical addresses, and phone numbers of the users. We noticed WHOIS records for some domains were dated and contained incorrect information about domain owners-people who no longer own these assets.

Prior to registering domains, domain registrars require users to provide their "WHOIS" contact information, such as email address, physical address, and phone number. This information becomes a part of the public WHOIS directory and is searchable by anyone for contacting the domain owner. Being public data, WHOIS records may be seen or scraped by anyone. Those who prefer not to disclose their personal information directly on a WHOIS directory often rely on a company or a private WHOIS provider to act on their behalf. However, what has gotten the users concerned in this case is that the presence of their contact information in Epik's data set could falsely portray them as having a connection to Epik when there was none.

"Wonder if there is any legal recourse once can take against [Epik] for harvesting data, and keeping it longer than expected in a cache for individuals who are NOT clients, and have had 0 business dealings with them? Is there a precedent for this?" asked TapEnvy.US, a Texas-based app development shop.

Epik confirms data breach, emails impacted people

Epik has confirmed the breach and is also emailing the impacted parties about an "unauthorized intrusion," according to screenshots shared by data scientist Emily Gorcenski and cybersecurity expert Adam Sculthorpe:

"As we work to confirm all related details, we are taking an approach toward maximum caution and urging customers to remain alert for any unusual activity they may observe regarding their information used for our services - this may include payment information including credit card numbers, registered names, usernames, emails, and passwords," reads Epik's email notice.

Although the company has not confirmed at this time if credit card information was also compromised, as a caution, users are encouraged to "contact any credit card companies that you used to transact with Epik and notify them of a potential data compromise to discuss your options with them directly."

Previously, an Epik spokesperson had told Ars that the company was not aware of any breach and was investigating the claims.

Users can check if their data has been exposed as a part of this hack at HaveIBeenPwned.com. Those whose contact information was exposed should keep an eye out for any phishing emails and online banking scams.

# data[].attributes.attachment_link.title
Epik data breach impacts 15 million users, including non-customers

# data[].attributes.attachment_link.description
Epik has now confirmed that an "unauthorized intrusion" did in fact occur into its systems. The announcement follows last week's incident of hacktivist collective Anonymous leaking 180 GB of data stolen from online service provider Epik. To mock the company's initial response to the data breach claims, Anonymous had altered Epik's official knowledge base, as reported by Ars.

# data[].attributes.headline
Far-Right Platform Gab Has Been Hacked—Including Private Data

# data[].attributes.subject
Far-Right Platform Gab Has Been Hacked—Including Private Data

# data[].attributes.body
62104153 Tanyalax Khodhreem

# data[].attributes.attachment_link.readable_text
When Twitter banned Donald Trump and a slew of other far-right users in January, many of them became digital refugees, migrating to sites like Parler and Gab to find a home that wouldn't moderate their hate speech and disinformation. Days later, Parler was hacked, and then it was dropped by Amazon web hosting, knocking the site offline. Now Gab, which inherited some of Parler's displaced users, has been badly hacked too. An enormous trove of its contents has been stolen-including what appears to be passwords and private communications.

On Sunday night the WikiLeaks-style group Distributed Denial of Secrets is revealing what it calls GabLeaks, a collection of more than 70 gigabytes of Gab data representing more than 40 million posts. DDoSecrets says a hacktivist who self-identifies as "JaXpArO and My Little Anonymous Revival Project" siphoned that data out of Gab's backend databases in an effort to expose the platform's largely right-wing users. Those Gab patrons, whose numbers have swelled after Parler went offline, include large numbers of Qanon conspiracy theorists, white nationalists, and promoters of former president Donald Trump's election-stealing conspiracies that resulted in the January 6 riot on Capitol Hill.

DDoSecrets cofounder Emma Best says that the hacked data includes not only all of Gab's public posts and profiles-with the exception of any photos or videos uploaded to the site-but also private group and private individual account posts and messages, as well as user passwords and group passwords. "It contains pretty much everything on Gab, including user data and private posts, everything someone needs to run a nearly complete analysis on Gab users and content," Best wrote in a text message interview with WIRED. "It's another gold mine of research for people looking at militias, neo-Nazis, the far right, QAnon, and everything surrounding January 6."

DDoSecrets says it's not publicly releasing the data due to its sensitivity and the vast amounts of private information it contains. Instead the group says it will selectively share it with journalists, social scientists, and researchers. WIRED viewed a sample of the data, and it does appear to contain Gab users' individual and group profiles-their descriptions and privacy settings-public and private posts, and passwords. Gab CEO Andrew Torba acknowledged the breach in a brief statement Sunday.

Passwords for private groups are unencrypted, which Torba says the platform discloses to users when they create one. Individual user account passwords appear to be cryptographically hashed- a safeguard that may help prevent them from being compromised -but the level of security depends on the hashing scheme used and the strength of the underlying password.

Among the users whose hashed passwords appeared to be included in the data were those for Donald Trump, Republican congresswoman and QAnon-conspiracy theorist Marjorie Taylor Greene, MyPillow CEO and election-conspiracy theorist Mike Lindell, and disinformation-spouting radio host Alex Jones.

The hacked data also includes a chatlogs.txt file that appears to contain private conversations between the site's users. That file's contents begin with an added note from JaXpArO: "FUCK TRUMP. FUCK COLONIZERS & CAPITALISTS. DEATH TO AMERIKKKA."

According to DDoSecrets' Best, the hacker says that they pulled out Gab's data via a SQL injection vulnerability in the site-a common web bug in which a text field on a site doesn't differentiate between a user's input and commands in the site's code, allowing a hacker to reach in and meddle with its backend SQL database. Despite the hacker's reference to an "Anonymous Revival Project," they're not associated with the loose hacker collective Anonymous, they told Best, but do "want to represent the nameless struggling masses against capitalists and fascists."

WIRED reached out to Gab for comment Friday, offering to share what we'd learned about the nature of the site's data breach. The company's CEO, Andrew Torba, responded in a public statement on the company's blog that "reporters, who write for a publication that has written many hit pieces on Gab in the past, are in direct contact with the hacker and are essentially assisting the hacker in his efforts to smear our business and hurt you, our users." (WIRED has had no direct contact with the hackers, to our knowledge, only DDoSecrets.)

"It's another gold mine of research for people looking at militias, neo-Nazis, the far right, QAnon and everything surrounding January 6."

Emma Best, DDoSecrets

Responding to WIRED's mention of a SQL injection vulnerability, Torba's initial statement noted that "we were aware of a vulnerability in this area and patched it last week. We are also proceeding to undertake a full security audit." The post went on to state that Gab doesn't collect personally identifiable information from its users such as telephone numbers, Social Security numbers, birth dates, or health and financial information. "DMs were only live for a few weeks and are not currently a feature supported by the site, so if a breach has in fact occurred in that domain we expect the number of affected accounts to be low," Torba added. "As we learn more about this alleged breach, we will notify the community publicly with our findings as required by law."

Torba did not confirm that a security breach had occurred in his Friday statement. But in a follow-up on Sunday, Torba used a transphobic slur to insult the hackers "attacking" the site and added that both his and Donald Trump's accounts had been "compromised." (DDoSecrets was careful to note to WIRED that it has not attempted to crack any of the hashed passwords or tested any of the plaintext passwords in the hacked data. WIRED hasn't either.)

"The entire company is all hands investigating what happened and working to trace and patch the problem," Torba wrote Sunday.

Gab is the second far-right social media site to be deeply hacked in as many months. Following the Capitol Hill riot in January, other hacktivists used a simple security flaw in the bustling social media site Parler to download all of its public contents, including the location data embedded in every photo and video Parler users had posted. That Parler data, which placed several users at Capitol Hill on January 6, was preserved by the Internet Archive and also made available by DDoSecrets.

When Amazon booted Parler from its hosting service in January, many of the site's users flocked to Gab. But until now, hacktivists have had a hard time downloading public Gab posts as they did with Parler, says Max Aliapoulios, a graduate researcher at the New York University Center for Cybersecurity, with whom DDoSecrets has shared a copy of the hacked Gab data. Due mostly to Gab's instability and frequent downtime, Aliapoulios found that he couldn't easily use an automated tool to scrape the site.

Aliapoulios, cocreator of the Social Media Analysis Toolkit, a project that analyzes online communities, argues that the leak of non-private data from Gab will serve a public interest. "This is all of Gab, and we didn't have to even run a crawler to get it," Aliapoulios says.

The data, he says, could offer a window into how users migrate from one service to another when facing bans or deplatforming and could even serve to help build tools to keep Gab's hate speech and disinformation from spreading to other sites. "There's so much hate, harassment, racism, neo-Nazism that occurs on a site like that," Aliapoulios says, "that having a record of that could help develop ways to automatically detect that type of content so that other places that don't allow it can remove it."

The Gab hack is just the latest in a recent string of apparent "hacktivist" breaches, many of which have ended with DDoSecrets publishing reams of stolen data, or making it privately available to journalists and researchers. DDoSecrets has also recently released hundreds of gigabytes of information a hacker took from corporations in Myanmar following the military coup there earlier this month. Over the summer, DDoSecrets rose to prominence with a massive leak of law enforcement data stolen by a hacker associated with Anonymous, which DDoSecrets dubbed BlueLeaks. And last month it controversially began publishing collections of corporate data stolen and leaked by ransomware hackers after their victims refused to to pay.

Compared with those ransomware leaks, DDoSecrets' decision to only privately share Gab's data may represent a lighter touch. DDoSecrets' Best argues that this approach minimizes the violation of innocent Gab users' privacy. "Journalists and researchers aren't going to be doing deep dives into people who only post about their kids' ballet recital and pictures of their pets," Best writes.

But given that other parts of the leak may go well beyond those personal details-and even offer insights into the January 6 Capitol riot, Best argues that Gab's data deserves scrutiny. "In a simpler or more ordinary time, it'd be an important sociological resource," Best writes. "In 2021, it's also a record of the culture and the exact statements surrounding not only an increase in extremist views and actions, but an attempted coup."

# data[].attributes.attachment_link.title
Far-Right Platform Gab Has Been Hacked-Including Private Data

# data[].attributes.attachment_link.description
When Twitter banned Donald Trump and a slew of other far-right users in January, many of them became digital refugees, migrating to sites like Parler and Gab to find a home that wouldn't moderate their hate speech and disinformation. Days later, Parler was hacked, and then it was dropped by Amazon web hosting, knocking the site offline.

# data[].attributes.attachment_link.readable_text
Personal data belonging to over 31 million customers of a popular virtual keyboard app has leaked online, after the app's developer failed to secure the database's server.

The server is owned by Eitan Fitusi, co-founder of AI.type, a customizable and personalizable on-screen keyboard, which boasts more than 40 million users across the world.

But the server wasn't protected with a password, allowing anyone to access the company's database of user records, totaling more than 577 gigabytes of sensitive data.

The database appears to only contain records on the app's Android users.

The discovery was found by security researchers at the Kromtech Security Center, which posted details of the exposure alongside ZDNet. The data was only secured after several attempts to contact Fitusi, who acknowledged the security lapse this weekend. The server has since been secured, but Fitusi did not respond when we asked for comment.

ZDNet obtained a portion of the database to verify.

Each record contains a basic collected data, including the user's full name, email addresses, and how many days the app was installed. Each record also included a user's precise location, including their city and country.

Other records are significantly more detailed. The app has a free version, which per its privacy policy collects more data than the paid version, which the company uses to monetize with advertising.

More complete records also include the device's IMSI and IMEI number, the device's make and model, its screen resolution, and the device's specific Android version.

A large portion of the records also included the user's phone number and the name of their cell phone provider, and in some cases their IP address and name of their internet provider if connected to Wi-Fi. Many records contain specific details of a user's public Google profile, including email addresses, dates of birth, genders, and profile photos.

We also found several tables of contact data uploaded from a user's phone. One table listed 10.7 million email addresses, while another contained 374.6 million phone numbers. It's not clear for what reason the app uploaded email addresses and phone numbers of contacts on users' phones.

Several tables contained lists of each app installed on a user's device, such as banking apps and dating apps.

It's not unusual for on-screen keyboards to have wide-ranging access to some of the highest levels of Android permissions. Android will warn users that keyboards "may be able to collect all the text that you type, including personal data like passwords and credit card numbers." AI.type is no exception, with read access to contact data, text messages, photos and video access and other on-device storage, record audio, and full network access.

For its part, AI.type says on its website that user's privacy "is our main concern." Any text entered on the keyboard "stays encrypted and private," says the company.

But the database wasn't encrypted. We also found evidence that text entered on the keyboard does get recorded and stored by the company, though to what extent remains unclear.

The company also promises to "never share your data or learn from password fields," but we saw one table containing more than 8.6 million entries of text that had been entered using the keyboard, which included private and sensitive information, like phone numbers, web search terms, and in some cases concatenated email addresses and corresponding passwords.

Bob Diachenko, head of communications at Kromtech Security Center, warned of the dangers of using free apps.

"Theoretically, it is logical that anyone who has downloaded and installed the Ai.Type virtual keyboard on their phone has had all of their phone data exposed publicly online," he told ZDNet. "This presents a real danger for cyber criminals who could commit fraud or scams using such detailed information about the user."

"It raises the question once again if it is really worth it for consumers to submit their data in exchange for free or discounted products or services that gain full access to their devices," he added.

"It is clear that data is valuable and everyone wants access to it for different reasons," he said. "Some want to sell the data they collect, others use it for targeted marketing, predictive artificial intelligence, and cyber criminals want to use it to make money in more and more creative ways."

You can send tips securely over Signal and WhatsApp at 646-755-8849. You can also send PGP email with the fingerprint: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.

# data[].attributes.attachment_link.title
A popular Android keyboard app leaks data on 31 million users

# data[].attributes.attachment_link.description
Personal data belonging to over 31 million customers of a popular virtual keyboard app has leaked online, after the app's developer failed to secure the database's server. The server is owned by Eitan Fitusi, co-founder of AI.type, a customizable and personalizable on-screen keyboard, which boasts more than 40 million users across the world.

# data[].attributes.headline
Twitter urges all users to change passwords after glitch

# data[].attributes.subject
Twitter urges all users to change passwords after glitch

# data[].attributes.body
62105309 Burutsakorn Saeton

# data[].attributes.attachment_link.title
Twitter urges all users to change passwords after glitch

# data[].attributes.attachment_link.description
Twitter Inc <TWTR.N> urged its more than 330 million users to change their passwords after a glitch caused some to be stored in readable text on its internal computer system rather than disguised by a process known as “hashing”.

# data[].attributes.headline
Ubiquiti tells customers to change passwords after security breach

# data[].attributes.subject
Ubiquiti tells customers to change passwords after security breach

# data[].attributes.body
62109905 Sanpakorn Pattamarak

# data[].attributes.attachment_link.readable_text
Image: Ubiquiti Networks

Networking equipment and IoT device vendor Ubiquiti Networks has sent out today notification emails to its customers informing them of a recent security breach.

"We recently became aware of unauthorized access to certain of our information technology systems hosted by a third party cloud provider," Ubiquiti said in emails today.

The servers stored information pertaining to user profiles for account.ui.com, a web portal that Ubiquiti makes available to customers who bought one of its products.

The site is used to manage devices from a remote location and as a help and support portal.

According to Ubiquiti, the intruder accessed servers that stored data on UI.com users, such as names, email addresses, and salted and hashed passwords.

Home addresses and phone numbers may have also been exposed, but only if users decided to configure this information into the portal.

How many Ubiquiti users are impacted and how the data breach occurred remains a mystery.

It is currently unclear if the "unauthorized access" took place when a security researcher found the exposed data or was due to a malicious threat actor.

A Ubiquiti spokesperson did not immediately return a request for comment send before this article's publication.

Despite the bad news to its customers, Ubiquiti said that it had not seen any unauthorized access to customer accounts as a result of this incident.

The company is now asking all users who receive the email to change their account passwords and turn on two-factor authentication.

While initially, some users looked at the emails as a phishing attempt, a Ubiquiti tech support staffer confirmed that they were authentic on the company's forums.

A full copy of the email is available below, as shared today on social media.

Image: Dangal Son

# data[].attributes.attachment_link.title
Ubiquiti tells customers to change passwords after security breach | ZDNet

# data[].attributes.attachment_link.description
Networking equipment and IoT device vendor Ubiquiti Networks has sent out today notification emails to its customers informing them of a recent security breach. "We recently became aware of unauthorized access to certain of our information technology systems hosted by a third party cloud provider," Ubiquiti said in emails today.

# data[].attributes.headline
Thousands of Apps Leak Sensitive Data via Misconfigured Firebase Backends

# data[].attributes.subject
Thousands of Apps Leak Sensitive Data via Misconfigured Firebase Backends

# data[].attributes.body
62103379 Danunuch Kongwatmai

# data[].attributes.attachment_link.title
Thousands of Apps Leak Sensitive Data via Misconfigured Firebase Backends

# data[].attributes.attachment_link.description
Thousands of iOS and Android mobile applications are exposing over 113 GBs of data via over 2,271 misconfigured Firebase databases, according to a report released this week by mobile security firm Appthority. Firebase is a Backend-as-a-Service offering from Google that contains a vast collection of services that mobile developers can use in the creation of mobile and web-based apps.

# data[].attributes.headline
533 million Facebook users' phone numbers and personal data have been leaked online

# data[].attributes.subject
533 million Facebook users' phone numbers and personal data have been leaked online

# data[].attributes.body
62107339 Panupong Kongsuwan

# data[].attributes.attachment_link.title
533 million Facebook users’ phone numbers and personal data have been leaked online

# data[].attributes.attachment_link.description
The data includes phone numbers, Facebook IDs, full names, locations, birthdates, bios, and, in some cases, email addresses.