Coachella Website Hack: 950,000 User Accounts For Sale On The Dark Web
Big data breach shows organisations of all sizes and sectors are open to the attentions of cyber criminals
Nearly a million user accounts linked to the website used for the US music festival Coachella are claimed to be up for grabs by a data trader on the dark web.
The trader, who goes by the handle Berkut, according to Motherboard, is attempting to sell the database for $300 on the Tochka marketplace, which included access to a mix of email addresses, user names, and hashed passwords.
Coachella cracked
It is not currently known how Berkut gained access to the data, whether it was through their own efforts or if the data was handed over to them to sell. However, it would not be a stretch of the imaginations to hazard a guess that a phishing attack was used to gain access to the Coachella website database.
Motherboard was able to gain access to a sample of more than 10,000 accounts and was able to verify that they are currently in operation by attempting to create a new account on the Coachella website by using the stole credentials.
It appears that no payment information was stole, but having access to such emails and data would allow for its owner to stage phishing attacks targeted at known emails addresses and use the information for other malicious cyber activity.
“You don’t even need to know Beyonce pulled out of the event to know this isn’t a good thing, as it opens the door to very personalised phishing attempts,” said Chris Boyd at cyber security researcher at Malwarebytes, indulging in a litany of musical puns. “Smooth criminals will no doubt fire off some fake refund/special festival deals at people who may not know about the breach, so it’s crucial we heal the world by ensuring word gets out about what happened.”
Such hacking attacks are normally aimed at larger enterprises, notably the infamous Yahoo hack. But the Coachella data breach indicated that no organisation with a trove of data is safe from the attentions of hackers and cyber criminals looking to make a quick buck or Bitcoin from pilfered data.
