Drivesure Data Breach Revealed

25 Sep Drivesure Data Breach Revealed

After a cybercriminal hacked the firm, and dump numerous databases of the firm onto hacking forums, personal data of millions of American automobile owners who enrolled to a roadside services program provided by drivesure is accessible online. A security vendor researcher Risk Based Security spotted the databases on the raidforums cracking forum past due last month and reported them to drivesure this week. The databases contain names, deals with volumes of cell phones, electronic mails. There is also information about the vehicles of customers, which includes their make, model and VIN numbers, along with service records and damage claims. The breach also contained 93,000 bcrypt hashed passwords which are generally used to protect the data stored in a secure application. However, these hashes could be forced by brute force if a bad actor spends days running scripts against them.

Drivesure is a service provider that assists car dealerships in building loyalty to their customers by using data about their interactions with customers. The Illinois-based business is focused on employee training programs and consumer retention, among other things.

Thompson exploited an unpatched vulnerability in the cloud firewall configuration to circumvent security measures in the company and gain access to directories and data buckets. Thompson then uploaded her stolen data on GitHub, and slowly updated the information as she continued to hack. The question of whether she was trying vpnversed.com/windscribe-review/ to make money from her attack is unclear. Other targets with a high profile have been attacked in recent weeks including unemployment claimants in Washington state who were snared by a security breach involving an unnamed third-party software system used by the auditor, and employees of the air charter firm Solairus Aviation.