NoName Hacking Group Targets Email[.]it

An Italian email service provider, Email[.]it, has experienced a data breach resulting in the exposure of data belonging to nearly 600,000 users. A hacker group called NN (No Name) Hacking Group claims to be responsible for the breach and that they have stolen 44 databases from Email[.]it's servers. The breached data is available for sale on the dark web for a price varying between 0.5 and 3 bitcoin ($3,500 and $22,000).

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

NN Hacking Group alleges to be an international hacking group with operatives from countries across the world. The group seeks payouts for hacking company servers. Initially they will try to get the company to pay a ransom to avoid public disclosure of stolen data. If a company refuses, they will then sell it on the dark web. No Name Hacking Group claims to have breached the Italian email provider, Email.it, two years ago. The breach timeline as detailed by the hackers is as follows:

January 01, 2018: NNHackingGroup compromised and dropped a backdoor in Email[.]it’s server and began to exfiltrate data from the company's servers.

February 1st, 2020: NNHackingGroup reached out to Email.it, disclosing the breach and requesting a ransom, but the company declined to respond.

February 18, 2020: Email.it quietly tried to patch their servers, but failed to prevent NNHackingGroup’s from retaining access. The company also refuted NNHackingGroup’s claims that passwords were saved in clear text.

Figure 1: NN Hacking Group’s official Web page.

April 05, 2020: NNHacking group published the stolen data, advertising their shaming website on Twitter where the data was made available for sale, for a price varying between 0.5 and 3 bitcoin ($3,500 and $22,000) depending on the data included.

Figure 2: NN Hacking Group’s Twitter handle, promoting the breached data available for sale and calling out the breached organization.

Figure 3: Screenshot of NN Hacking Group’s price chart for Email.it’s data.

The group was likely able to gather so much information because Email[.]it allegedly saved all passwords in cleartext, allowing the hackers to access the accounts of nearly 600k users. The hackers were able to steal about 44 databases containing the user and business information from 2007 to 2020. The exposed information included:

Usernames
Passwords (Plaintext)
Mobile numbers
Email addresses
Email content and attachments
Sent/Received SMS information
Sent/Received Fax information
Web application source code

Figure 4: NNHG-provided sample data exposing user passwords stored in plain text.

Figure 5: NNHG-provided sample data exposing Email.it’s web application source code.

Figure 6: NNHG-provided sample data exposing unencrypted emails and attachments.

Conclusion

NoName Hacking Group is the latest in a string of self-proclaimed hacking groups that seeks to name and shame victims. These groups generally breach their victims, gather sensitive data, and threaten to publicly release this info if the ransom is not paid. If the breached organization does not pay the ransom demand, they are named on a blog or website run by the hacking team, and the stolen information is posted for the world to see. This is done to increase the likelihood that a victim will pay. ZeroFOX recommends enacting the recommendations above to reduce risk of compromise due to a third-party breach.