Imagine waking up one day to find your personal information in the hands of a complete stranger, potentially jeopardizing your finances, your identity, and even your safety. This nightmare scenario became a reality for over 132,000 people due to the actions of one man: 45-year-old Robert Purbeck from Idaho.

Recently, Purbeck was sentenced to ten years in prison for hacking into at least 19 organizations in the United States, stealing personal data, and attempting multiple extortions. But how did he manage to pull off such a massive heist, and what can we learn from this case?

A Dark and Twisted Tale of Hacking and Extortion

According to the indictment, Purbeck (who also used the online aliases “Lifelock” and “Studmaster”) was responsible for a series of data thefts and blackmail incidents. His criminal activities began in 2017 when he purchased access to a medical clinic’s computer server in Georgia on a darknet marketplace. Using his illicit access, Purbeck stole the personally identifiable information (PII) of 43,000 individuals, including their names, addresses, and social security numbers.

But he didn’t stop there. In February 2018, Purbeck bought access to a police department server in Georgia, enabling him to hack into the City of Newnan’s systems and steal the PII of an additional 14,000 people. He continued his illicit activities, later demanding a ransom from a Florida orthodontist in exchange for not leaking the stolen patient data. Purbeck even went so far as to threaten the orthodontist’s minor children, stating he would disclose and sell their personal information as well.

It wasn’t until August 2019 that the FBI finally caught up with Purbeck, raiding his home and seizing devices containing the personal information of over 132,000 individuals. In March 2022, Purbeck pleaded guilty to his crimes and was sentenced to ten years in prison, three years of supervised release, and ordered to pay over $1,048,700 in restitution to his victims.

What We Can Learn from This Case

Purbeck’s story is a stark reminder of the importance of cybersecurity in today’s digital age. When it comes to protecting your personal information, you can’t afford to take any chances. Here are a few key lessons we can take away from this case:

• Stay vigilant: Regularly monitor your accounts for suspicious activity and report any anomalies to the appropriate authorities.
• Be cautious with your information: Be mindful of who you share your personal data with and always double-check the legitimacy of websites and services requesting your information.
• Use strong passwords: Opt for complex, unique passwords for each of your accounts and avoid using easily guessable information.
• Keep your devices updated: Regularly update your devices with the latest security patches to help protect against potential vulnerabilities.

A Call to Action: Stay Informed and Stay Protected

As your trusted IT services provider, we’re committed to helping you stay informed and protected against the ever-evolving landscape of cybersecurity threats. Whether it’s through educational resources or expert advice, our goal is to empower you to safeguard your privacy and protect your personal information.

Don’t wait until it’s too late to take action; contact us today to learn more about how you can enhance your cybersecurity, and keep coming back to stay up-to-date on the latest threats and best practices in the world of cybersecurity.

Imagine your business contact information—your name, phone number, email, even your job title—floating around the internet. Now, imagine that information belonging to 122 million people being available since February 2024. That’s exactly what happened, and we’ve now confirmed it was stolen from a B2B demand generation platform.

This massive data breach occurred at DemandScience (formerly Pure Incubation), a company that aggregates data for digital marketers and advertisers. Their job is to collect, compile, and organize data from public sources and third parties, creating valuable “profiles” to generate leads and marketing information.

How the Breach Happened

In February 2024, a threat actor named ‘KryptonZambie’ began selling 132.8 million records on BreachForums, claiming the data was stolen from an exposed system belonging to Pure Incubation. When we contacted DemandScience about the alleged data theft, they denied any breach had occurred, stating that their systems were secure behind firewalls, VPN access, and intrusion detection systems.

Fast forward to August 15, 2024, and KryptonZambie made the dataset available for a mere 8 credits (a few dollars), essentially leaking the data for free.

Confirmation of the Data Breach

Today, cybersecurity expert Troy Hunt published a blog post confirming that the data is authentic. According to Hunt, someone exposed in the leak contacted DemandScience and was told that the leaked data originated from a system that had been decommissioned two years ago.

The email from DemandScience read, “We have conducted a thorough internal investigation and conclude that none of our current operational systems were exploited. We also conclude that the leaked data originated from a system that has been decommissioned for approximately two years.”

Hunt verified the authenticity of the data, even finding his own record from when he worked at Pfizer. All 122 million unique email addresses from the stolen dataset have now been added to Have I Been Pwned, and exposed subscribers will receive notifications about the breach.

Don’t Be a Victim: Stay Informed and Protected

This massive data breach serves as a stark reminder of the importance of cybersecurity. As a U.S. reader, you may not be familiar with all the ins and outs of cybersecurity, but that doesn’t mean you can’t stay informed and protected.

Keep coming back to learn more about the latest developments in cybersecurity, and don’t hesitate to contact us if you have any questions or concerns. Together, we can make the digital world a safer place.

A Major Cybersecurity Breach Unfolds

Imagine this: you wake up one morning and find out that your personal data has been stolen. Not just a few pieces of information, but terabytes worth of sensitive data. Well, that’s exactly what happened to over 165 organizations that fell victim to a massive cybersecurity breach at the hands of two hackers who targeted the Snowflake cloud storage company.

Recently, the U.S. Department of Justice unsealed the indictment against the two suspected hackers, Connor Riley Moucka and John Erin Binns. These cybercriminals are accused of using stolen credentials to hijack Snowflake accounts that weren’t protected by multi-factor authentication. Once inside, they exfiltrated massive amounts of data and demanded ransom payments in exchange for deleting the stolen information.

Major Corporations Caught in the Crossfire

According to the indictment, the hackers managed to steal approximately 50 billion customer call and text records from a major U.S. telecommunications company. One company that fits the profile and suffered a massive data breach during the same timeframe as the indictment is AT&T. In July, they disclosed that call logs of 109 million customers were exposed during the incident when the data was accessed from their Snowflake account.

But AT&T wasn’t the only corporation targeted. Data breaches linked to Snowflake attacks affected hundreds of millions of individuals, customers of Ticketmaster, Santander, Pure Storage, Advance Auto Parts, Los Angeles Unified, QuoteWizard/LendingTree, and Neiman Marcus.

The Hackers’ Sneaky Tactics

Once the data was stolen, the hackers demanded ransoms in the form of cryptocurrency. They attempted to hide their tracks by conducting “a complex series of cryptocurrency transactions” and even converting the payments into Monero cryptocurrency. In some cases, the attackers engaged in double extortion, where they tried to get a new ransom payment from a breached company that had already paid the initial demand.

The indictment reveals that the two hackers and their co-conspirators extorted at least 36 Bitcoins, or $2.5 million, from three victims. For those victims that didn’t pay the ransom, the hackers advertised the stolen data to potential buyers on multiple hacking forums.

Justice Is Served

In late October 2024, Moucka (aka “Waifu” and “Judische”) was arrested in Canada, while Binns (aka “irdev” and “j_irdev1337”) was arrested in Turkey in May. The two now face multiple counts for various cybercrime charges, including wire fraud, securities fraud, conspiracy to commit fraud, unauthorized access and breach of computer systems, data theft, and privacy violations.

If convicted, the pair could face significant prison sentences, ranging from 5 to up to 25 years for each charge, totaling 60 years. Additionally, their assets and proceeds will be seized by the government, including bank accounts, vehicles, real estate, and any other valuables obtained as a result of their alleged offenses.

Don’t Be the Next Victim

The story of these hackers serves as a stark reminder that cybersecurity is more important than ever. Don’t let your organization become the next victim. Reach out to us at IT Services, and we’ll help you protect your valuable data from cybercriminals. Let’s work together to stay one step ahead of the hackers and keep your information safe. Remember, knowledge is power, so keep coming back to learn more about how you can protect your organization from cyber threats.