It all started in February 2024, when a user with the pseudonym “KryptonZambie” put 132.8 million contacts up for sale on a hacker forum. The information includes names, addresses, emails, telephone numbers, job titles and links to social media profiles. The origin of this database is quickly attributed to DemandScience, a company specializing in data collection for B2B marketing.
The danger of retired databases
When questioned at the time, the company strongly denied any security breach. “ Our systems are protected by firewalls, VPNs and intrusion detection systems. We found no evidence of hacking “, declared Derek Beckwith, director of communications. However, the available data samples did seem to come from their databases, but the company was content to promise reinforced monitoring without saying more.
The matter could have ended there, but in August, the data resurfaced, this time given almost free of charge, for a few symbolic dollars. Enough to arouse suspicions about their authenticity.
It was finally in November 2024 that Troy Hunt, cybersecurity expert and creator of the site Have I Been Pwned (HIBP), puts an end to doubts: the data is authentic. According to him, a person affected by the leak contacted DemandScience, which eventually admitted that the information came from a system that had been disabled for two years.
In an email, the company explains: “ After investigation, we confirm that our current systems have not been compromised. The leak concerns an old system that has been decommissioned for about two years. » Troy Hunt even found his own information in the database. Proof of the age of the data: they went back to the time when he worked at Pfizer.
Since then, 122 million unique emails have been added to the HIBP site. Affected users will receive a notification to check if their data is part of this leak. While the case is particularly embarrassing for DemandScience, it highlights a broader problem: neglect of legacy systems.
Too many companies forget that even “retired” databases can still be the object of covetousness. This leak is a reminder that when it comes to cybersecurity, anything left alone can come back to haunt its owner.
Source: www.journaldugeek.com
