The database containing 10GB worth of user information of three VPN
services such as ChatVPN, SuperVPN, and GeckoVPN was leaked in the
Telegram Groups.
On May 7th, 2022, the data of 21 million users was leaked, exposing the personal details and login credentials of the users.
The Data Breach:
Telegram uses encryption and offers its users anonymity. It is also
easily accessible and doesn’t require any technical skills. This makes
it the perfect platform for hackers to post data breaches, even more so
if they want more people to have access to them.
The leaked records of users contain the following information:
- Full names
- Usernames
- Country names
- Billing details
- Email addresses
- Randomly generated password strings
“It appears that the passwords were either hashed and salted or
random, without collision. This means each password hash is different,
making them harder to crack”, say the experts from VPNMentor.
Also, 99.5% of the email addresses were Gmail accounts, which is much
higher than the average percentage. This can be understood that the
group who shared the dump shared a subset of data and not the entire
dump.
The Possible Impact of the Breach
In this scenario, the experts say the affected users would become a
victim of blackmail. The attackers might send phishing messages and
scams to exposed users via email, using their full names and other
personal details that only the company could know about, such as
usernames, countries, or billing details, to build trust.
Hackers can read a password, take control of the user’s account, and take advantage of their premium status.
Also, the exposed database could end up in the hands of a restrictive
government in a country where VPN use is banned or access to specific
sites is blocked. This would allow the authorities to potentially arrest
dissidents and VPN users.
Recommendations for Protection
Experts recommend VPN users change the password with a random
combination of upper and lower case letters, numbers, and symbols for
utmost security. Also, ignore any suspicious SMS messages and emails and
educate yourself about phishing attacks, scams, malware, and other
forms of cybercrime.
Source:gbhackers.com