Two major data centres in Asia hacked, data of multiple leading domestic enterprises leaked

According to Bloomberg, over the past two years, hacking organizations have infiltrated multiple data centers in various regions around the world, obtaining login credentials of numerous giant global enterprises, and selling them in packages on the dark web for USD 175,000.

Malicious cyber activities targeting data center organizations establish a major precedent in the field of supply chain cybersecurity, and it is expected that attackers will increase malicious cyber activities related to data centers and their customers.

It is reported that cyberattacks stole data center credentials of more than 2,000 companies, including Alibaba, Amazon, Apple, BMW, Goldman Sachs, Huawei, Microsoft, and Walmart.

This is a landmark event highlighting the vulnerability of the global computer network. By hacking into Asia's largest data centers, hackers obtained login credentials of global giant corporations, meaning they have secured the keys to a vast treasure trove of potential wealth.

▍Large-Scale Data Leaks: Domestic Leading Enterprises Need to Be Especially Vigilant

Investigations show that hackers obtained the emails and passwords of multiple giant corporate users from two of Asia's largest data centers: GDS Holdings Ltd., headquartered in Shanghai, and ST Telemedia Global Data Centres, headquartered in Singapore.

Both GDS Holdings and ST Telemedia are among the largest data center service providers in Asia. The connection between the two operators is also very close; in 2014, ST Telemedia's parent company, Singapore Technologies Telemedia Pte, acquired a 40% stake in GDS. GDS is also one of the top three hosting service providers in China.

More than 2,000 companies were affected by this data leak. Based on currently available information, hackers have already used the login credentials of at least 5 of these companies, but it is currently impossible to know how other login credentials have been utilized by the hackers.

GDS said in a statement that its customer support website was breached in 2021. It remains unclear how hackers obtained ST Telemedia's data. The company stated that it found no evidence that its customer service portal website had been breached that year.

Both data centers stated that the compromised credentials do not pose a risk to customers' IT systems or data. However, in January this year, both operators forced corporate customers to reset their login passwords.

Such a massive data leak highlights the growing risks companies face as they rely on third parties to house data and IT equipment, and to help their networks enter the global market. Security experts say that China is the world's second-largest hosting services market, behind only the United States, so this issue is particularly severe for domestic enterprises.

▍Stolen Data Dumped for Free on the Dark Web, Packaged for Sale at USD 175,000

In late January, after GDS and ST Telemedia changed customer passwords, hackers posted the databases for sale on dark web forums.

The post read: "The database contains customer information, which can be used for phishing, accessing cabinets, monitoring orders and equipment, and remote manual orders."

Hackers had obtained the login credentials for more than a year before selling them on the dark web last month for USD 175,000, stating that they could not process such a massive amount of data because more than 2,000 companies were involved. Some sources indicate that the hacking group seems to be dumping the stolen data for free on the dark web.

It has not yet been possible to link these attacks to known hacking groups. When data center operators force password resets, hackers may sell the information, thereby reducing its value. Experts say the theft of credentials indicates that attackers are exploring new methods to penetrate physical hardware facilities.

Hackers obtained the complete email addresses and passwords of more than 3,000 individuals from GDS, including the company's own employees and customers, as well as information on more than 1,000 individuals from ST Telemedia. For security purposes, the data was hashed or encrypted, but documents show that this encrypted data could be easily decoded with simple tools. These email addresses and passwords allowed hackers to masquerade as authorized users on the customer service website.

▍An Epochal Data Leak Will Bring Incalculable Losses

Documents show that hackers also stole the credentials of more than 30,000 surveillance cameras in GDS's network, most of which relied on simple passwords such as "admin" or "admin12345."

According to relevant documents, other companies whose employees' login information was leaked include: Bloomberg, ByteDance, Ford, Mastercard, Morgan Stanley, Paypal, Porsche, SoftBank, Telstra, Tencent, Verizon Communications, and Wells Fargo.

The number of login credentials for customer support websites varied by customer. But hackers only needed one valid email address and password to access a corporate account on the customer service portal website.

Even though both operators have forced customer password resets, this data remains highly valuable — hackers can use it to craft targeted phishing emails to attack high-privilege management personnel.

"This is a predictable nightmare."

Executives from several companies said that the theft of credentials is an unusual security risk because the customer support website controls who can physically access the data center's IT equipment.

Malcolm Harkins, former Chief Security and Privacy Officer at Intel, said that the physical security of IT equipment in third-party data centers and the systems controlling access present vulnerabilities that corporate security departments often overlook.

For any data center operator, the worst-case scenario is that an attacker somehow accesses a customer's server and installs malicious code or additional equipment, thereby causing large-scale disruption to communications and business systems.

We recommend that any company relying on third-party hosting for data and IT equipment take proactive defensive measures. Similarly, enterprises with self-built data center rooms or those using public clouds also need to prepare proactive defenses in advance. The SecXen Security Metrics Validation Platform provides you with an attack library from which you can screen attack techniques based on ATT&CK. You can log into the platform and select relevant attack techniques such as "Credential Access," "C&C Callback," and "Data Leakage" to verify whether your security defense system can withstand this data leak crisis by simulating real-world attack scenarios.

| Reference Source: https://www.bnnbloomberg.ca/hackers-scored-data-center-logins-for-some-of-the-world-s-biggest-corporations-more-than-a-year-ago-now-they-re-selling-that-information-1.1886086