The Mother of All Breaches?

Yeah, that's what some people are saying: the "Mother of All Breaches" (MOAB). What does that mean? What happened? The security researcher Volodymyr "Bob" Diachenko, in collaboration with the Cybernews team, allegedly, recently discovered a massive data breach with more than 26 billion records. This is more than three times the number of human beings on Earth today. But has this finding been properly named?

What the research team specifically found in an "open instance" was a judiciously organized database with nearly 4,000 folders taking up around 12 terabytes. The thing is that each folder contains records of a separate data breach, many of which had already been reported previously. So, although it was the researchers who apparently dubbed it "MOAB," this finding looks more like a database of multiple data breaches. The team even expressed that it is highly probable that there are duplicates in that database but that there seems to be new user data included anyway. Nonetheless, instead of saying the "mother of all data breaches," I think it is more appropriate to call it "the largest compilation of multiple breaches," as curiously Cybernews later referred to it in its own publication.

OK, but where did all that data come from? When I first read about this discovery, there was no statement from a criminal group taking responsibility. But today, January 26, Malwarebytes said in an updated post that the source of the dataset was Leak-Lookup. Believe it or not, this is a data breach search engine that "allows you to search across thousands of data breaches to stay on top of credentials that may have been compromised." And precisely, Leak-Lookup shows on its website a total of about 26 billion records, corresponding to 4,176 breaches.

So, did the breach (or should we say the leak?) occur to a company that has collected and is collecting data breaches? (I had forgotten for a time the risk exposure these data aggregation services pose.) Affirmative. In fact, Leak-Lookup posted on its X account on January 23 (linking to the original Cybernews post of January 22) that all that issue was the product of a firewall misconfiguration on their systems that they had already fixed. According to Malwarebytes, the affected company said the initial access to its dataset was reached in December last year.

Let's face it. It all sounds bizarre. Not only the fact that Cybernews talked about it as the "mother of all breaches" when they knew it was not (clickbait strategy?), but also that they didn't immediately report that they already knew the source of all that data. (On January 26, Cybernews was still not reporting it. Update: They came to do so on January 29.) Moreover, both the discoverer and source of discovery are teams that collect records of data breaches on the Internet. (Yes, Cybernews has its data leak checker.) Leak-Lookup's post even began with the phrase, "We certainly weren't expecting that publicity." What does that mean? I smell a rat here. But, well, I'd rather not go around speculating, at least not anymore.

Anyway, knowing that there is a lot of sensitive data floating around the Internet —possibly including yours— that malicious actors can leverage for attacks such as targeted phishing, credential-stuffing, and identity theft, we invite you to keep in mind the following, for some perhaps already trite, recommendations:

Are you a Fluid Attacks customer and have not yet downloaded our VS Code extension? We invite you to do so to take advantage of automatic vulnerability remediation through generative AI. Not familiar with our solutions? Start a 21-day free trial right now.