Cyber-security researchers on Wednesday revealed that hackers have compromised the swachh.city platform, an initiative of the swachh bharat mission in association with the ministry of housing and urban Affairs, that could put 'critical information' of nearly 16mn (million) users at risk.
From the data sample that was disclosed by the threat actor to substantiate his claim on the Dark Web, researchers were able to assess registered email addresses, password hashes, registered phone numbers, transmitted OTP (one-time password) information, login IPs, individual user tokens, and browser fingerprint information of the affected users.
The threat intelligence team of AI-driven Singapore-headquartered CloudSEK said the breach of the swachhata platform is the handiwork of threat actor LeakBase.
The finding showed that critical information of approximately 16mn users could be ending up in the wrong hands.
"The adversary, going under the monikers of LeakBase, Chucky, Chuckies, and Sqlrip on underground forums has shared a database containing Personal Identifiable Information (PII) such as email addresses, hashed passwords, User IDs etc, that allegedly affects 16 million users of the swachh city platform," the researchers noted.
LeakBase often operates for financial gain and conducts sales on its marketplace forum on the Dark Web.
"The database of size 1.25 GB has been disclosed under the post and has been hosted on a popular file-hosting platform," informed the team.
LeakBase also offers access to admin panels and servers of most CMS (content management systems).
"As individuals whose personal details such as phone numbers and email addresses are advertised for sale, there is a strong possibility of it being used against them," said CloudSEKA.
This information can be harvested by threat actors to conduct phishing, in the form of fake breach notice emails from Swachh City, and social engineering to reveal more sensitive information.
It would equip malicious actors with details required to launch sophisticated ransomware attacks, exfiltrate data, and maintain persistence, warned researchers.
This information can also be aggregated to be sold further as leads on cybercrime forums.
"Implement a strong password policy and enable MFA (multi-factor authentication) across logins. Patch vulnerable and exploitable endpoints and monitor for anomalies in user accounts, which could indicate possible account takeovers," advised the researchers.
Disclaimer: Information, facts or opinions expressed in this news article are presented as sourced from IANS and do not reflect views of Moneylife and hence Moneylife is not responsible or liable for the same. As a source and news provider, IANS is responsible for accuracy, completeness, suitability and validity of any information in this article.