If You Use ProxyScrape, the 2022 Data Breach Should Worry You

In May 2022, Netherlands-based proxy provider ProxyScrape suffered a data breach after a development instance was left publicly accessable on the internet. The exposed environment contained records on 8,296 users including their email addresses and IP addresses, the very data that sits at the core of what a proxy service is supposed to protect.

What Attackers Can Do With Proxy User Data

Knowing which IP addresses belong to ProxyScrape customers gives attackers the ability to impersonate legitimate users, abuse proxy allocations for botting and scraping operations, and cross-reference IP logs against other breach data to identify individuals who rely on proxies for privacy. Email addresses from the leak can be used to phish customers with spoofed ProxyScrape communications.

What Was Exposed in the ProxyScrape Breach

• Email Address
• IP Address

Why Exposed Development Instances Carry Outsized Risk

Development environments often contain real user data copied from production for testing purposes, but they rarely have the same access controls applied. When a dev instance is left open to the public internet, it is only a matter of time before it is discovered by automated scanners. This occured at ProxyScrape and the data found its way onto hacking forums where it was discussed and traded. ProxyScrape has since acknowledged the breach and reset proxy access keys.

How a Database Breach Works

A database breach occurs when an unauthorized party gains access to stored records, whether through active exploitation or passive misconfiguration. In cases like ProxyScrape, no sophisticated attack was needed. The data was simply left in a location where anyone who knew to look could find it. Once discovered, the contents are downloaded, packaged, and distributed through underground channels.

Check If Your Data Was Exposed

HEROIC's DarkWatch monitors over 400 billion records from breaches across every sector, including the ProxyScrape incident. Search your email address now to find out if your information has been compromised and take steps to protect your accounts.