The recent major Dell data breach appears to be a little more damaging than initially thought, following reports that the same threat actor managed to abuse the same flaws to steal even more data.
A hacker named Menelik recently managed to steal confidential data from 30,000 Dell customers. The data includes individual names, phone numbers, email addresses, service reports, hardware replacement data, various hardware components, customer device diagnostic logs, and more. In some cases, the data even included photographs taken by Dell customers that, among the metadata, included precise GPS locations of where the photographs had been taken.
Some of the data even belongs to customers in the European Union, which could trigger the GDPR with EU regulators.
selling the information
For now, TechCrunch He says he has seen the data and it appears to be authentic. Speaking to the publication, the hacker said there are currently no concrete plans for the database: “I found something for email data and phone numbers,” Menelik told TechCrunch. “But I'm not going to do anything with that yet. “I want to see how Dell responds to the current issue.”
News recently broke that a hacker stole and offered to sell mailing address information belonging to 49 million Dell customers, among other things. The data was obtained by the same threat actor, Menelik, apparently from different Dell portals. They did this by registering multiple “partner” accounts and then brute-forcing customer service tags.
The initial batch of 49 million tickets was put up for sale on a dark web portal and the post was removed shortly after. That suggests that Menelik managed to sell the database to someone, although until the information is abused in one way or another, it's impossible to know. So far, there are no reports that anyone has used the information for malicious purposes.
