7591 Records Exposed in Power-Werks Breach

On November 20, 2024, our monitoring systems flagged unusual activity originating from a public Telegram channel. We noticed a significent data dump containing credentials and personal identifiable information (PII) that, upon initial analysis, appeared to be linked to the Power-Werks platform. What struck us was the relatively high number of unique email addresses and the inclusion of bcrypt hashed passwords, suggesting a direct database compromise rather than a credential stuffing attack. The structured nature of the leaked data also pointed towards a well-defined extraction process.

The breach, discovered on November 20, 2024, involved the exfiltration of approximately 33,000 records from Power-Werks, a US-based SaaS provider. The exposed dataset contained 7,591 unique email addresses, alongside first names, last names, and bcrypt hashed passwords. While the provided description mentions physical addresses, our analysis of the leaked data sample primarily confirmed email, name, and password hash fields. The source structure indicates a direct database dump, likely facilitated by an SQL injection vulnerabilty or compromised administrative credentials. The data was subsequently disseminated on a private Telegram channel, a common tactic for initial monetization or further exploitation by threat actors.

While there is no immediate widespread news coverage of this specific Power-Werks incident, the methodology aligns with prevalent threat actor tactics. The use of Telegram for data distribution is well-documented in numerous OSINT reports and cybersecurity research papers concerning data breaches and illicit marketplaces. The presence of bcrypt hashed passwords, while a stronger hashing algorithm than MD5 or SHA-1, still presents a risk if weak password policies were enforced or if brute-force attacks are employed against the hashes. This incident underscores the ongoing challenges in securing sensitive user data within SaaS environments.