Another South African organisation denies a major data breach
The Wanderers Club and Wanderers Stadium have joined Telkom in denying that they were targeted in a series of alleged breaches by a threat actor against South African organisations in May.
All three organisations rubbished the threat actor’s claims that their customer data was stolen, saying their investigations found no link between the hacker’s purported samples posted online and their data.
On 27 May, a poster on a popular hacker forum said that they were selling private data allegedly belonging to Wanderers, Telkom and auto parts supplier Midas.
MyBroadband contacted the three affected companies and received feedback from Telkom, Lions Cricket, which operates the Wanderers Stadium, and later The Wanderers Club.
The Wanderers Club is a 138-year-old sports club in Illovo, Johannesburg. It said that it found no evidence that the breach was legitimate.
It said that it immediately contacted its technology service provider, Yolo, which began reviewing the sample data, file names and available indicators in relation to the alleged breach.
The threat actor, called Databasehooligan, said that they were selling alleged private customer information from “Wanderers.” They posted samples of the allegedly stolen data.
Databasehooligan claimed the dataset contained full names, email addresses, membership tiers, genders and language preferences. Over 674,000 records were allegedly up for sale.
The data samples also purported to show information on club memberships, fee structures, and booking details for sports such as squash or tennis.
“The sample data and file names do not align with the data structures, records, categories, or systems held or managed for The Wanderers Club,” said Frank Auger, club general manager.
Yolo could not find any evidence linking the alleged dataset to the Wanderers Club official website, the club’s member database, its website infrastructure or Yolo-managed systems.
Auger said that known club access-control or operations systems were also unaffected by any recent breaches based on the analysis.
He also indicated that the website that the threat actor claimed to have obtained the information from, Wanderers.co.za, was in no way related to the club.
Authenticity of breaches called into question
Lions Cricket, the owner and operator of Wanderers Stadium in Illovo, provided feedback confirming that the site belonged to the stadium but said it was “parked and dormant”.
They said the data appeared to belong to the Wanderers Club or another third party and stated that their own systems were unaffected.
However, the Wanderers Club has since said that this assumption was incorrect, as the data samples posted by the threat actor did not originate from its systems.
Databasehooligan has been a prolific poster on the hacker forum and claimed to have accessed data from numerous companies and organisations across the globe.
Each database was put up for sale, including three claimed to have been obtained from South African entities: Midas, Telkom, and Wanderers.
Databasehooligan claimed it was selling 742,000 records obtained from Telkom, including private customer details and other alleged internal documentation.
Each of their forum posts was structured the same way, with only specific company or data details changing the layout. The leaks were also posted in quick succession.
Some of the alleged data from Telkom included what the threat actor said was taken from the telecom’s internal ticketing and support system.
However, Telkom told MyBroadband on Thursday that it had found no evidence that its systems were compromised or that customer data had been accessed, sold, or exposed.
“Telkom employs robust, multi-layered cybersecurity measures and continuous monitoring to safeguard customer information and protect against malicious activity,” the company said.
Loading ...