Breach Disclosure: Mulitple VPN Services

Breach Disclosure: Multiple Free VPN Services

On February 25th 2021, a post advertising breached data for sale on 3 popular free VPN apps was published on a popular hacker forum. The impacted services are SuperVPN, GeckoVPN, and ChatVPN with over 21 million total user records for sale. The breached data contains sensitive information of the services customers including names, email address, geo location, IP Addresses, payment history and more.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The post advertising the data for sale details the services which were breached along with the date the information was breached, which was the 24th February 2021- a day before the post was created. Links are included to sample sets of the data along with contact information of the post author, under the alias of 000 and soapceo.

Figure 1: Post advertising breached data for sale

The samples of data include the SQL schema of the databases which were breached. These list columns which contain data including:

• Email address
• Username
• Alias
• Geo location
• Passwords (randomly generated strings)
• Payment-related data
• Platform
• Device OS version
• App version
• IMSI number
• Manufacturer/model information

Figure 2: Table schemas from SQL dump samples