Hackers sell personal data of millions of people in Moscow for only $800

Notably, this database contains personal information of millions of road users, and is offered on an underground forum for only $ 800.

As revealed by a Russian security unit that purchased this database, the entire data appears to be valid, and contains a large number of records collected between 2006 and 2019. According to statistical results and preliminary investigation, the personal information of many people in this stolen database is correct. Although outdated in some cases, it is still a 'real person'.

The database contains the following details about car owners in Moscow:

1. Full name
2. Date of birth
3. Phone number
4. VIN
5. License plates
6. Car brand and model
7. Vehicle registration year

In addition, the hacker also included an additional compressed file containing the information collected in 2020. That is very new.

Hackers sell personal data of millions of people in Moscow for only $800 Picture 1

The origin of the data has not been revealed yet

According to the hacker group's statement, this data packet originated from the Moscow traffic police department. City officials have not yet commented on the report, while Russian security circles are divided over who is responsible for the breach.

Some cybersecurity experts believe that hackers stole the data by exploiting a vulnerability in the system software of the Moscow traffic police department. While others claimed one or more individuals 'in the industry' were the culprits behind the leak.

Analysts at InfoWatch Group offer a different perspective, suggesting that a cyberattack on car insurance companies is also a possible explanation. The reason is that a large amount of information in the leaked data is found in the systems of these companies.

In fact, this is not the first time the personal data of Moscow car owners has been leaked for sale on the dark web. In August 2020, a similar, but smaller data package (1 million records) was launched on hacking forums, with a selling price of $ 1,500.

The reason the database of 50 million records mentioned above is sold for quite cheap, only 800 USD, is because it mainly contains old information, which has been collected for a long time. Quite a few of them are no longer worth exploiting, so have little effect on malicious actors.

However, these data can still be valuable in various phishing and extortion activities. It allows crooks to carry out phishing campaigns targeting exposed individuals, thereby illegally profiting in many forms.

Marvin Fry

Update 25 October 2021