09 Nov
Prestige Software
Prestige Software accidentally exposes millions of guest user data and reveals massive sensitive user information The online company operates the biggest hotel online services with Hotels.com, Booking.com, and Expedia.
Prestige Software accidentally exposes millions of guest user data from its online cloud and reveals massive sensitive user information for public access and use. The online company operates the biggest hotel online services with Hotels.com, Booking.com, and Expedia, which have its user data stored in an open cloud.
The Madrid and Barcelona-based technology and computer services company, Prestige Software, was recently discovered for having low security for its online databases that store guests’ highly sensitive user information. The company’s websites are an Amazon Web Services S3 bucket and are highly-rated and used in the hotel industry.
Experts have warned before that these online hotel services are easily breached and susceptible to significant attacks and data breaches. Now, the warnings are slowly coming to reality with Prestige Software’s recent discovery by concerned users and Website Planet.
Bigbasket
Bigbasket, a prominent online grocery store in India, allegedly suffered a data breach, details of over 20 million people available on the dark web.
BigBasket was founded by Alibaba Group, Mirae Asset-Naver Asia Growth
Fund, and the CDC group, it has over 18,000 products from over 1000
brands in its listing.
The database of BigBasket is availble for sale in a cyber-crime market. The archive is 15 GB in size and contains 20 million user records, it is being sold for over $40,000.
The database includes names, email IDs, password hashes (potentially hashed OTPs), contact numbers (mobile + phone), addresses, date of birth, location, and IP addresses of login among many others.
Cit0Day
More than 23,000 hacked databases are said to have originated from Cit0Day.in, a private service has been made available for download on various channels in what threat intel analysts are calling the biggest leak of its kind.
More than 23,000 hacked databases have been made available for download on several hacking forums and Telegram channels in what threat intel analysts are calling the biggest leak of its kind.
The database collection is said to have originated from Cit0Day.in, a private service advertised on hacking forums to other cybercriminals.
Cit0day operated by collecting hacked databases and then providing access to usernames, emails, addresses, and even cleartext passwords to other hackers for a daily or monthly fee.
Cybercriminals would then use the site to identify possible passwords for targeted users and then attempt to breach their accounts at other, more high-profile sites.
The idea behind the site isn’t unique, and Cit0Day could be considered a reincarnation of similar “data breach index” services such as LeakedSource and WeLeakInfo, both taken down by authorities in 2018 and 2020, respectively.
GrowDiaries
Cannabis journaling platform GrowDiaries exposed more than 3.4 million user records online, many from countries where pot is illegal.
A database linked to GrowDiaries, an online community of cannabis growers, has exposed more than a million users’ email addresses, passwords, IP address records and posts.
GrowDiaries is a robust online community of cannabis growing enthusiasts from around the world, where they can share tips, tricks and pictures of their progress. On Oct. 10, researcher Volodymyr “Bob” Diachenko found a database linked to GrowDiaries with 1.4 million email and IP address records, along with an additional 2 million user posts, left accessible online.
These 2 million posts were protected by passwords, but Diachenco found GrowDiaries was using MD5 to hash out passwords, which is easily compromised and leaves members vulnerable to malicious actors, according to Diachenko.