Remove when-is-a-scrape-a-breach
article thumbnail

When is a Scrape a Breach?

Troy Hunt

Is this a data breach? No security controls were breached by the person who downloaded it, they simply accessed a publicly available file. Same question again - breach or not? But this is public profile information - stuff I consciously added to Gravatar knowing it would be publicly accessible - so is it a breach?

article thumbnail

Hackers, Scrapers & Fakers: What's Really Inside the Latest LinkedIn Dataset

Troy Hunt

I like to think of investigating data breaches as a sort of scientific search for truth. Verification that supports the alleged source is usually quite straightforward , but disproving a claim can be a rather time consuming exercise, especially when a dataset contains fragments of truth mixed in with data that is anything but.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Weekly Update 385

Troy Hunt

Right from the beginning, it was pretty obvious what "MOAB" was probably going to be and sure enough, this tweet came true: Interesting find by @MayhemDayOne , wonder if it was from a shady breach search service (we’ve seen a bunch shut down over the years)? and been shut down by law enforcement agencies.

Marketing 222
article thumbnail

Weekly Update 332

Troy Hunt

Breaches all over the place today! Well, this past week, and there's some debate as to whether one of them is a breach, a scrape or if the term just doesn't matter anyway. Zurich Japan was breached (big name, but small portion of people already in HIBP) Autotrader had a heap of data breacraped (breached?

204
204
article thumbnail

How Spoutible’s Leaky API Spurted out a Deluge of Personal Data

Troy Hunt

Here goes: Last week, someone reached it to me with what they claimed was a Spoutible data breach obtained by exploiting an enumerable API. Just your classic case of putting someone else's username in the URL and getting back data about them, which at first glance I assumed was another scraping situation like we recently saw with Trello.

Passwords 363
article thumbnail

“The mother of all breaches”: 26 billion records found online

Malwarebytes

Security researchers have discovered billions of exposed records online, calling it the “mother of all breaches” However, the dataset doesn’t seem to be from one single data breach, but more a compilation of multiple breaches. Atlassian, the company that runs Trello, however denies there has been a breach.

article thumbnail

Second colossal LinkedIn “breach” in 3 months, almost all users affected

Malwarebytes

LinkedIn has reportedly been breached— again —following reports of a massive sale of information scraped from 500M LinkedIn user profiles in the underground in May. This suggests that the data was scraped rather than breached. How was the seller able to scrape hundreds of millions of records?