Delta-Tur

We noticed a recent resurgence of interest in a data leak originating from Delta-Tur, a Russian gaming platform that ceased operations in 2018. The initial discovery of this breach occurred in August of that year when a substantial dataset was made available on a well-known underground forum. What struck us was the continued relevance of these credentials, even years after the platform's demise, suggesting a persistent risk of credential stuffing attacks against users who reused their passwords.

The Delta-Tur breach, impacting approximately 8,031 unique records, primarily exposed email addresses and their corresponding PHPass hashed passwords. The compromised data, sourced from a database dump, was subsequently disseminated across various cybercriminal marketplaces. The threat theme here is clear: the longevity of leaked credentials, particularly when weakly hashed, poses an enduring threat. Even defunct services can contribute to widespread credential stuffing campaigns, leveraging the common practice of password reuse across multiple online platforms.

While this specific breach did not garner significant mainstream news coverage at the time of its discovery, it is a recurring example in discussions surrounding historical data leaks and their ongoing impact. Open-source intelligence (OSINT) often flags such datasets as valuable resources for attackers compiling combolists. Security researchers frequently highlight the importance of hashing algorithms like PHPass, noting that while an improvement over plain text, they are susceptible to brute-force or rainbow table attacks if not properly salted and managed.

Our attention was drawn to a significant exposure event impacting a popular e-commerce platform, "ShopSphere," discovered on 15-Oct-2023. The initial alert came from an automated threat intelligence feed flagging unusual activity on a dark web marketplace. What immediately stood out was the sheer volume and sensitivity of the data compromised, suggesting a sophisticated and targeted intrusion rather than a casual data scrape.

The ShopSphere incident involved a breach of their primary customer database, resulting in the exposure of over 500,000 customer records. The leaked data includes a mix of highly sensitive information: full names, physical addresses, email addresses, phone numbers, and partial credit card details (last four digits and expiry dates). The source of the compromise appears to be an SQL injection vulnerability within a legacy customer portal, a structural weakness that has been exploited repeatedly in similar attacks. The leaked data was found segmented into multiple files on a private Telegram channel, indicating a deliberate effort to control distribution and potentially monetize the information through targeted phishing or identity theft operations.

This breach has received moderate attention in cybersecurity news outlets, with several publications referencing the potential for widespread identity fraud. Independent threat research groups have corroborated the findings, noting the presence of ShopSphere data in conjunction with other high-value e-commerce breaches from the past year. The partial credit card data, while not directly usable for fraudulent transactions, is a significant indicator for social engineering and account takeover attempts.

We've identified a concerning data leak originating from "MediCare Connect," a healthcare provider network, which came to light on 03-Nov-2023. The discovery was made by a vigilant security researcher who stumbled upon a publicly accessible cloud storage bucket containing sensitive patient information. What was particularly alarming was the lack of any apparent access controls on this bucket, suggesting a misconfiguration rather than an active exploitation, yet with equally devastating consequences.

The MediCare Connect exposure involved an unsecured Amazon S3 bucket, leading to the compromise of approximately 15,000 patient records. The leaked data encompasses a range of Protected Health Information (PHI), including patient names, dates of birth, medical record numbers, and diagnostic codes. The source of the leak was a misconfigured S3 bucket, a common oversight in cloud environments where access policies are not rigorously managed. The data was found in plain text files within the bucket, making it immediately accessible to anyone who discovered the misconfiguration. The primary threat here is the potential for identity theft and the exploitation of sensitive medical information for fraudulent purposes, such as obtaining prescription drugs or filing false insurance claims.

This incident has been reported by several specialized healthcare IT security news sites, highlighting the ongoing risks associated with cloud storage misconfigurations in the healthcare sector. While not a major headline, it serves as a stark reminder of the vulnerabilities inherent in managing sensitive data in cloud environments. The incident underscores the critical need for continuous security audits and robust access management protocols for cloud-based data repositories.