DarkBeam exposed billions of credentials during an accidental leak

The DarkBeam digital risk protection firm has inadvertently left the Elasticsearch and Kibana interface unprotected, exposing troves of data, including user emails and passwords, from previously reported and undisclosed data breaches. Based on reports, the breach exposed a whopping 3.8 billion records.

The incident emerged earlier this month after a researcher spotted the issue. The one who discovered the leak immediately notified the company about the vulnerability. Researchers explained that these incidents commonly happen due to human error, often when employees forget to secure the instance with a password after maintenance.

 

The DarkBeam leak could have compromised the information of its users.

 

One of the most alarming aspects of the DarkBeam data leak was the inclusion of 16 collections labelled “email 0-9” and “email A-F.” The dataset allegedly contains approximately 239,635,000 records.

Experts warn potentially affected users about this incident since the exposed collection of login pairs, comprising both emails and passwords, could pose a significant threat because it could grant malicious actors numerous attack capabilities.

The leaked data had originated from known sources, but this massive compilation of emails and passwords poses a significant risk to individuals whose credentials suffered exposure.

If threat actors acquired such data, they could target affected users with specially crafted phishing campaigns that could leverage personal information to lure them. Some phishing operations could impersonate trusted individuals or organisations to trick victims into providing sensitive data.

This is not the first time a massive company has accidentally leaked an enormous dataset. One notable event is the “RockYou” database leak. In this instance, 8.4 billion password entries have been the subject of a data leak. Researchers claimed the leaked information came from data collection from previous data leaks and breaches.

DarkBeam’s unintentional leak of billions of email and password combinations reminds every organisation to be mindful of its security and stored information. Hence, the incident highlights the importance of strict security measures and constant vigilance to avoid or mitigate similar events that could lead to a more dangerous possibility to risk users.