Breach Disclosure: db8151dd

An unknown source of compromised user data has been identified on a publicly accessible Elasticsearch database containing over 22 million email addresses from various users. The source of this data is unknown at this time, and has researchers baffled as to how it was compiled. There are around 103 million rows of data in the database, all prefixed with the 'db8151dd' identifier, which is where the name comes from.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

In February of 2020, Dehashed (a popular credential compromise site) discovered, or was given, a massive dump from an exposed Elasticsearch database, totalling around 90GB of data in all. The data appears to be scraped from multiple sources, however, what makes this data unique is that some records were identified as being associated to each other, where one person would appear next to another person whom they had some relationship or interaction with.

Also included in this data along with the interactions was case records appearing to be from some judicial website containing these sorts of records. Some of these relationships and data could be attributed to comments like the ones below which were found in the database:

"This contact information was synchronized from Exchange. If you want to change the contact information, please open OWA and make your changes there." "Exported from Microsoft Outlook (Do not delete)" "Contact Created By Evercontact"

The above comments could indicate that contact books were somehow collected from a variety of compromised accounts, however, for the number to reach in the millions, this would be a rather large compromise. This could also explain the relationships between people being displayed in the data, but still leaves questions as to where it came from, and does not explain the court records included here as well.

Figure 1: Sample of data contained in the breach