DIGITAL LIFE

Hackers put stolen data from tech giants' data centers up for sale

Unknown parties have gained access to Asian data center login data, which could give cybercriminals the opportunity to spy on the world's biggest companies or even sabotage their daily operations, security firm Resecurity has reported. Companies such as Apple, Microsoft, Amazon, Alibaba, Goldman Sachs and Walmart use the services of data center operators GDS Holdings of Shanghai and ST Telemedia of Singapore.

The data theft may have involved 2,000 Chinese companies and exchange platforms whose login details were offered for sale by hackers on various hidden forums in the form of a package. According to Bloomberg, the stolen logins belonged to customer service interfaces, and third parties visited at least five of those sites with access. Email addresses and passwords allowed them to impersonate authorized users.

The experts did not say exactly which companies were actually accessed. The number of login credentials for customer service websites varied for different customers: Alibaba had 201 accounts, Amazon had 99, Microsoft had 32, Baidu had 16, and Apple had 4 accounts. With a valid email and password, hackers can access the company's account through the customer service portal.

According to guesses, the criminals have been in possession of the accesses for a year, but only started trading them on the dark web in January at a price of US$ 175,000, and the package offered later became available for free. Data centers forced all their customers to change their passwords at the beginning of the year, but according to indications, computer systems and customer data are not at risk.

Access to customer service systems is a risk as customer service sites regulate who can physically access IT equipment located in data centers. Some of the potentially affected companies contacted by Bloomberg did not comment. According to Microsoft, it constantly analyzes threats and is prepared for this type of abuse. According to BMW, the problem had a very limited effect on its activities, no damage was caused and, according to Amazon, its security system and services were not affected at any level.

The case highlights that relying on third parties for collocation of data and IT equipment is an increasingly real security risk for companies, a problem particularly typical of China, where companies must cooperate with local data providers. The worst case scenario for any data center operator is for attackers to somehow gain physical access to customer servers and install malicious code or additional equipment. This can significantly disrupt communication and commerce.

So far, Resecurity has not been able to link the attacks to any hacking group. According to the security company, the hackers probably put the information up for sale after the operators asked to change the passwords, as a significant part of them had already become invalid.

Author: Zsuzsanna Dömös