N4ughtySecTU posts old Cell C contract subscriber database, and private ANC member data

[ToxicBunny]

"they found an account whose password was “password”"

There is your problem, right there. We all know you should use numbers and special characters. That is why all my passwords are 'password#01'.

Idiots.

Poor form jannie..

P@55w0rd! Is all you nees

 

[cyb3rt]

P@55w0rd!

This thing! I wanted to **** bricks at my old company when I heard / saw this exact one from users..

 

[j4ck455]

According to the metadata of the leaked files, the ANC database is from 21 August 2017, while the Cell C database is dated 3 October 2010.

Is MyBB 100% sure that these "hackers" didn't buy those off the dark web (from a real hacker group that got the data years ago and has been selling it ever since)?

N4ughtySecTU is starting to sound like one/both of Zuma's twins (and no I'm not referring to his m00bs).

 

[rvZA]

Is MyBB 100% sure that these "hackers" didn't buy those off the dark web (from a real hacker group that got the data years ago and has been selling it ever since)?

This was exactly my thoughts.

 

[Pak Fa Fui]

This was exactly my thoughts.

Well they need to cross reference the leaks, should be easy to do.
The dates of the info they chose to release are suspicious.

 

[rvZA]

Well they need to cross reference the leaks, should be easy to do.
The dates of the info they chose to release are suspicious.

They can't, because they most likely did not get the information from Transunion servers. Unless, unless of course, Transunion themselves bought these databases in circulation and integrated the data into their own system and keeping copies of the databases on the server.

 

[DXL]

Credit Beaureaus should not keep anything more than your full name and ID number. Everything else is not required to keep credit records for a person.

 

[supersunbird]

Credit Beaureaus should not keep anything more than your full name and ID number. Everything else is not required to keep credit records for a person.

So they should not keep your credit payment history? What is the purpose of your "full name and ID number" bureau?

And no details like addresses so that red flags can be raised if none of the new credit request info matches?

 

[neoprema]

I would also like to know so I can see what of my personal data was included. Or if somebody has access just pop it over to Troy Hunt to add to "have I been pawned"... https://www.troyhunt.com/contact/

My data is already leaked everywhere, I don't need ANOTHER copy sitting on Troy's servers.

 

[CruelBreeze]

This thing! I wanted to **** bricks at my old company when I heard / saw this exact one from users..

You can view people's passwords?

 

[CruelBreeze]

If it’s transunion, chances are every company will have some link to them in some way. Why Cell C and ANC?

Maybe just what the user had access to.

 

[supersunbird]

You can view people's passwords?

Of course, in IT support one sometimes needs to get the password from the user, unless the user wants to spend all their time just sitting next to you to enter their password when required.

 

[cyb3rt]

You can view people's passwords?

Nah, like @supersunbird pointed out, and users tend to leave passwords plastered all over their desks and I had to get some of the junior guys to stop setting that as the default when resetting for users etc.

 

[system32]

N4ughtySecTU makes a pretty good p@55w0rd

 

[mpdjhb]

You can view people's passwords?

You dont need to - you can run your own brute force with top 1000 or try reverse the hashes etc

 

[Johand]

My data is already leaked everywhere, I don't need ANOTHER copy sitting on Troy's servers.

Nah -- Troy is very diligent. The sensitive data is hashed using a one-way hash and web requests that deal with sensitive data uses k-anonymity. The service doesn't require or store the data in raw form - it only needs to answer whether the data is in the set of leaked data and not what the exact data is, so hashes is enough.

 

[neoprema]

Nah -- Troy is very diligent. The sensitive data is hashed using a one-way hash and web requests that deal with sensitive data uses k-anonymity. The service doesn't require or store the data in raw form - it only needs to answer whether the data is in the set of leaked data and not what the exact data is, so hashes is enough.

and he gets the hashes how? if he's generating them, he has a copy of the raw data to generate them?

 

[rvZA]

and he gets the hashes how? if he's generating them, he has a copy of the raw data to generate them?

Of course he has the raw data. It is all stored in MySQL databases.

 

[6spdmanual]

Link?