A large data leak from an AFL fan website has exposed around 70 million records online, including private conversations between users, according to cyber security researchers.
Aussie Rules forum Bigfooty.com has around 100,000 users - although it's not known how many were affected.
Cyber security research team Safety Detective, led by Anurag Sen, claim to have discovered around 132GB of data leaking from the site last month.
In a report provided exclusively to 9News, the researchers claim they were able to view private messages, some containing email addresses, mobile phone numbers, passwords and other sensitive personal information.
In some cases, messages included threatening or racists comments.
"Private messages are fully exposed in the leak and can be traced back to specific users. This includes some high-profile users such as Australian police officers and government employees," the report reads.
"Even though usernames, passwords and identities were not always matched, there remains a significant risk that the tidbits of information available could be used to commit identity fraud, and consequently, create financial, social and reputational damage on users."
The researchers say in several cases users who shared sensitive material could be identified.
"Sensitive material of this nature exposes those users to blackmail and coercion by malicious hackers, assuming their identity can be determined," the report reads.
"A further issue -- and one that is common with data leaks in general -- is users sharing passwords to other platforms, or, reusing the same username and password on multiple platforms."
The research lab, which describes itself as a "pro bono service that aims to help the online community defend itself against cyber threats", told 9News it immediately contacted Big Interest Group, the US-based parent company of Bigfooty.com.
A spokesperson for Big Interest Group told 9News the unsecured port had been fixed on May 14.
"We have started sending out notices to potentially affected users informing them of the issue," they said.
"Apart from access by (Safety Detective), we have not found evidence the index was copied or downloaded by other parties."
"As it relates to data of users based in Australia, we are also preparing a report for the Office of the Australian Information Commissioner."
The researchers also contacted the Australian Cyber Security Centre and host-server Amazon.
While the ACSC won't comment on individual cases, a spokesperson said: "Databases and storage services are potential targets of malicious cyber actors and are vulnerable to compromise if not properly secured."
BigFooty.com posted a notice on its website on Friday morning, saying "the situation only applies to people who have posted sensitive information in private conversations, restricted forums and other places with any amount of restricted access."
"Most people won't have shared private info like phone numbers and bank details and other sensitive information. However, it can't be fully determined who has shared what, so everyone who has ever posted in a private forum has been emailed.
"It seems there's no evidence that the search index was copied in full. The main forum server is not affected. The breach does not include information provided at registration."
from 9News https://ift.tt/2Xd14W1
via IFTTT
0 Comments