603
15M Trello accounts have been leaked (lemy.lol)
submitted 2 years ago* (last edited 2 years ago) by to c/technology@lemmy.world
101 comments fedilink hide all child comments
 

I just got the email from haveibeenpwned. F Trello.

you are viewing a single comment's thread
view the rest of the comments
[–] 14 points 2 years ago* (3 children)

tbf it's just email, username and real name so it's basically nothing when half of users are name.lastname@gmail.com either way.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 2 years ago (2 children)

    For project tools like Trello, a good portion of your userbase is company emails. A malicious actor now has a list of company emails that they can compare against public facing data like Linkedin, imitate a user using a gmail based off their name, sending an email to that company's IT team asking for an MFA reset sent to the newly created gmail account. Now imagine if that compromised user is a developer with admin access to production environments. These were the conditions for various ransomware attacks.

    An email, username, real name are not much, but it's a foot in the door.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago* (1 child)

    It is a foot in the door but honestly there are way too many doors out there so it's really hard to measure the real damage of this.

    I worked at a pretty major employment company like 20 years ago when basically everything was legal and we didn't need to buy dark web datasets to find real names and contacts ever - most of that data is publicly available and can be captured with simple public scrapers and email checks.

    I think expectation of names and emails being private should be thrown out of the window entirely and every security system should implicitly assume these details are publicly known.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 years ago

    So the conditions I mentioned were directly from a series of ransomware attacks from the group BlackCat including the high profile ransomware incident targeting MGM Casinos last year. My team recently used the same premise during an incident response drill based on that event.

  • permalink
  • fedilink
  • source
  • parent