Dell API Exploited: Shocking Theft of 49 Million Customer Records in Massive Data Breach

Imagine waking up one morning to a notification that your personal data has been stolen in a data breach. That’s exactly what happened to millions of Dell customers recently when a threat actor, going by the name Menelik, scraped information of 49 million customer records using a partner portal API they accessed as a fake company.

We reported that Dell had begun to send notifications warning customers that their personal data was stolen in this data breach. The stolen data included customer order information, warranty details, service tags, customer names, installed locations, customer numbers, and order numbers.

So, How Did This Happen?

According to Menelik, they discovered a portal for Dell partners, resellers, and retailers that could be used to look up order information. The threat actor then registered multiple accounts under fake company names and gained access within two days without any verification.

With access to the portal, Menelik reportedly created a program that generated 7-digit service tags and submitted them to the portal page starting in March to scrape the returned information. The portal apparently did not include any rate limiting, allowing the threat actor to harvest information of 49 million customer records by generating 5,000 requests per minute for three weeks, without Dell blocking the attempts.

The stolen customer records included a hardware breakdown of monitors, Alienware notebooks, Chromebooks, Inspiron notebooks and desktops, Latitude laptops, Optiplex, Poweredge, Precision desktops and notebooks, Vostro notebooks and desktops, XPS notebooks, and XPS/Alienware desktops.

Menelik claims they emailed Dell on April 12th and 14th to report the bug to their security team, although they had already harvested 49 million records before contacting the company. Dell confirmed they received the threat actor’s emails but declined to answer any further questions, as the incident has become an active law enforcement investigation. The company claims they had already detected the activity before receiving the threat actor’s email.

APIs: A Growing Weakness in Data Security

Easy-to-access APIs have become a massive weakness for companies in recent years, with threat actors abusing them to scrape sensitive data and sell them to other threat actors. In 2021, threat actors abused a Facebook API bug to link phone numbers to over 500 million accounts. This data was leaked almost for free on a hacking forum, only requiring an account and paying $2 to download it.

Later that year, in December, threat actors exploited a Twitter API bug to link millions of phone numbers and email addresses to Twitter accounts, which were then sold on hacking forums. More recently, a Trello API flaw was exploited last year to link an email address to 15 million accounts, which were again put up for sale on a hacking forum.

While all of these incidents involved scraping data, they were allowed due to the ease of access to APIs and the lack of proper rate limiting for the number of requests that can be made per second from the same host.

What Can You Do About It?

As cybersecurity experts, we want to help you stay protected and informed. Don’t wait for the next data breach to happen. Stay up-to-date on cybersecurity news, tips, and advice by following our IT Services page. Knowledge is power, and we’re here to keep you in the loop. And if you have any questions or concerns about your own cybersecurity, don’t hesitate to reach out to us. We’re always here to help.