Notorious data leak site BreachForums appears to be back online after it was seized by law enforcement a few weeks ago.
At least one of BreachForums domains and its dark web site are live again. However, questions have been raised over whether it is a genuine attempt to revive the forums once again or set up as a lure by law enforcement to entrap more data dealers and cybercriminals.
The administrator of the new forum posts under the handle ShinyHunters, which is a name associated with the AT&T breach and others, and believed to be the main administrator of the previous BreachForums.
Yesterday, ShinyHunters posted a new dataset for sale that allegedly stems from Live Nation/Ticketmaster.
Post by ShinyHunters to sell the Live Nation Ticketmaster data set
> “Live Nation / Ticketmaster
>
> Data includes
>
> 560 million customer full details (name, address, email, phone)
>
> Ticket sales, event information, order details
>
> CC detail – customer last 4 of card, expiration date
>
> Customer fraud details
>
> Much more
>
> Price is $500k USD. One time sale.”
But, an avatar and a handle are easily copied, and there are a few things that raised our spidey-senses that something is up.
First, the data set was offered for sale on another dark web forum by a user going by SpidermanData with the exact same text.
SpidermanData offering the same data set on another forum
Second, this data set seems way too big for its nature. Live Nation and Ticketmaster are big enough to be considered a monopolist, but 560 million users seems like a stretch.
After looking at the shared evidence, security researcher CyberKnow tweeted:
> “While there is some new data in the shared evidence there is also old customer information, making it possibly this is a series of data jammed together.”
Third, a new feature is that visitors need to register before they can see any content. Why would the administrators change that?
And, last but not least, would the FBI let the cybercriminals regain control over the domains that easily? That would be quite embarrassing.
So, we dare conclude that this dataset's goal is to generate some attention and act as a lure to let old forum users know that BreachForums is alive and kicking. But who is running the show, is the question that we hope to answer soon.
Stay tuned for updates on this developing story.
There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.
Our Digital Footprint portal allows you to quickly and easily check if your personal information has been exposed online. Just enter your email address (it’s best to submit the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report.
We don't just report on threats - we help safeguard your entire digital identity
Cybersecurity risks should never spread beyond a headline. Protect your—and your family's—personal information by using identity protection.