Data Breach: Vianet

Breach Disclosure: Vianet

Personal details, including names, locations, emails, phone numbers and addresses of around 170,000 Vianet customers have been leaked online stemming from a breach this month. The breach was first disclosed by hackers this past Tuesday for one of Nepal's leading ISP's. It is unclear what the source of the breach was, and Vianet officials have not disclosed how this breach happened, only that they have identified and found the source of the breach.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

On April 21, 2020, hackers disclosed the breach on Twitter. Another hacker who had compromised the food delivery platform Foodmandu had posted praise and links to the hacker's twitter account claiming they had dumped 160,000 records from Vianet, and claimed that the dump appeared legitimate.

Figure 1. Hacker responsible for Foodmandu breach praising Vianet hacker

The hacker posted a link to an .onion site containing the breach data, with the original tweet and account being suspended due to violating Twitter's Terms of Service.