Drivesure, a dealership service provider, was hit by an attack on its database in December last year. The result was that 26GB of private information was downloaded and then shared via hacking forums. The data hacked contained names addresses, addresses, and telephone numbers of 3.2 millions buyers and also messages sent via email and text messages between customers and traders vehicles, VINs of their vehicles, and service records. Also, more than 93 000 hashed bcrypt passwords were released. Although bcrypt hashes are thought to be superior to older methods such as SHA1 or MD5 However, they could be used to force brute-force after downloading, according to Risk Based Security.
Hacker “pompompurin” revealed the leaked data and user vpnversed.com/ details in a lengthy blog post on Raidforums. This is unusual as hackers typically only share important portions or cut-down versions of the databases they’ve found.
The database was leaked because an error in configuration in an AWS bucket that was used by the company, according to CISO Magazine. The AWS bucket was left unprotected, allowing anyone to gain access to the contents and data. This included over 1 million email addresses in plaintext, as well passwords encrypted with Bcrypt.
The breach is a serious worry for those who utilize drivesure, as they are more likely to be victims of identity theft or fraud if their details are stolen. Users of the site must change their passwords as soon as possible. They should also consider changing their login credentials on other websites using the same credentials.