Even big tech companies are exposed to critical cybersecurity incidents. Specialists in secure data erasure report that an alleged hacker (self-appointed Shiny Hunters) claims to have stolen more than 500 GB of data stored in Microsoft’s private repositories on GitHub.
The alleged hacker contacted the moderators of the specialized platform BleepingComputer, to which he confirmed he managed to download the 500 GB of private projects in order to sell the information, although he notes that he changed his mind and decided to leak them at no cost.
From the timestamps on the leaked files, experts in secure data erasure deduced that the data breach may have occurred on March 28, 2020. In addition, Shiny Hunters told BleepingComputer that he no longer has access to the compromised account.
The threat actor offered to post 1 GB of files on a hacking forum for registered members to use site ‘credits’ to gain access to the exposed data. As some of the leaked files contain Chinese text or references to latelee.org, other hackers who frequent this forum do not feel that the data is real.
In addition, in a list of directories and samples from other private repositories sent to the platform, the stolen data appears to be mainly code samples, test projects, an e-book and other generic articles, as mentioned by experts in secure data erasure. However, some other repositories appear to contain more important information, but not enough for Microsoft to be sufficiently interested in the incident.
On the other hand, a researcher at cyber intelligence firm Under the Breach claims that he was able to access the full leak in the hacker forum, although he also doesn’t think there’s much to worry about. Still, the researcher exaggerated his concern that the API’s private keys or passwords may have been accidentally left in some of the private repositories, as other developers did in the past.
In this regard, Sam Smith, a Microsoft employee, responded to Under the Breach by stating that he thought the leak was false as “Microsoft has a rule that says GitHub repositories must become public after 30 days”. BleepingComputer tried to contact Microsoft, but the company has not responded.
For further reports on vulnerabilities, exploits, malware variants and computer security risks you can access the website of the International Institute of Cyber Security (IICS), as well as the official platforms of technology companies.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
