Two mobile forensic firms become victims of a data breach

Two mobile forensic firms, Cellebrite and MSAB, have been recent targets of threat actors, stealing massive amounts of data from them. About 1.7TB of data have been nicked from the Israel-based firm, Cellebrite, and 103GB was stolen from the Swedish company MSAB.

Both the stolen data from the two mobile forensic firms were uploaded to the websites of DDoSecrets and Enlace Hacktivista. According to a statement shared by the Enlace Hacktivista admins, the data from the two victimised firms was uploaded by an “anonymous whistleblower.”

 

The two mobile forensic firms have often received backlash for facilitating the government in spying on activists, officials, journalists, and protesters.

 

One of the most utilised Cellebrite tools of government groups and intelligence agencies was the UFED (Universal Forensics Extraction Device) for extracting and analysing data from mobile devices. Many of this tool’s targets were human rights activists, journalists, and dissidents, contributing to the garnered criticisms of Cellebrite.

On the other hand, MSAB is also heavily criticised for servicing repressive regimes. It is one of the many European firms that receive public EU funding, such as the flagship technological program ‘Horizon Europe’ and the ‘Formobile’ project, which aims to develop a technology that can unlock mobile phones without user consent and then extract and analyse data for criminal investigations.

In a turn of events, the two mobile forensic firms become victims of a data breach attack, with both stolen databases available on the DDoSecrets and Enlace Hacktivista websites through torrents and direct downloads.

Aside from the “anonymous whistleblower” who had allegedly provided the stolen databases from the two firms, there are no more details known about the databases’ source and validity.

Posted last January 13, the leaked databases allegedly contained Cellebrite’s 1.7TB worth of full-suite programs, such as the UFED flagship, Physical Analyser (and its Ultra version), license tools, the Cellebrite Reader, technical guides, and customer documents archives data from November 19 to December 3 last year.

There is no information yet about which data was compromised from MSAB.