The recent data breach at Dell has raised concerns about the security of customer information. According to a person claiming to have accessed 49 million Dell customer records, the breach occurred when they brute-forced an online company portal and scraped customer data directly from Dell’s servers. TechCrunch verified that some of the scraped data matches the personal information of Dell customers.
In response, Dell sent an email to customers acknowledging the breach and assuring them that there is not a significant risk to their personal information. However, this attempt to downplay the impact of the breach has raised eyebrows, as it seems to suggest that customer addresses are not highly sensitive information.
The threat actor responsible for the breach revealed that they registered with several different names on a Dell portal as a “partner.” They were then granted access to a portal where they were able to brute-force customer service tags and access sensitive information. The threat actor claims to have sent thousands of requests per minute for nearly three weeks before notifying Dell of the vulnerability. It took Dell nearly a week to patch the issue.
The stolen database of customer data was subsequently listed on a well-known hacking forum. TechCrunch confirmed the legitimacy of the stolen data by sharing a handful of names and service tags with customers, who confirmed that they had received the breach notification email from Dell.
However, there are cases where the threat actor could not find certain information, leading them to question how Dell identified the impacted customers. Dell has not disclosed who the physical addresses belong to. Upon analyzing a sample of scraped data, TechCrunch found that the addresses appear to be linked to the original purchaser of Dell equipment. In some cases, these addresses were also found to be the home addresses of consumers who bought directly from Dell.
When contacted for comment, Dell did not dispute TechCrunch’s findings but did not provide evidence to support their claim that they were already aware of and investigating the breach prior to receiving the threat actor’s email. Dell emphasized that the threat actor is a criminal and that they have notified law enforcement.
This data breach at Dell highlights the importance of robust security measures to protect customer information. It also raises questions about the adequacy of Dell’s response and their handling of sensitive customer data. Customers should remain vigilant and take steps to protect their personal information in the wake of this breach.
