- A dark web seller presents a database allegedly belonging to millions of users of ActMobile, which owns Dash VPN and FreeVPN.
- The exposed information contains sensitive personal details, which may lead to credential stuffing, account takeover, and exposure of the user’s identity.
- Security experts warn users to immediately change their passwords and enable two-factor authentication to reduce the risk of unauthorized access to their accounts.
A threat actor on a dark web forum has posted an advertisement offering what they claim is a massive user database from ActMobile, the firm that operates Dash VPN and FreeVPN. The seller alleges the compromised information includes roughly 45.6 million user records tied to the company’s VPN offerings.
The exposed dataset reportedly contains email addresses, IP addresses, password hashes, user account records, and authentication-related information; the threat actor claims there are 45,674,633 records in the database that have circulated through underground channels. Cybersecurity experts are recommending that individuals treat these claims as unverified until there is independent verification of their validity.
VPN providers handle user data that contains very sensitive, private data. The risk to privacy and data security increases if there’s a compromise of account details, email addresses, and IP information, although the passwords exist as hashes.
Compromised data from this incident may lead to further credential-based attacks, not only against the VPN platform, but also for any other sites on which individuals have reused their login credentials.
Stolen Data Could Enable Multiple Attack Vectors
The exposed information creates several potential dangers for affected users. Credential stuffing is probably one of the more obvious dangers to someone with a compromised account through a data breach. This is because most end users will use the same email and password combination to log into different online accounts. Therefore, the hacker would have access to all the accounts that are using the same credentials.
Account takeover attempts could target both the VPN services themselves and other platforms where users maintain accounts. Criminals who successfully access VPN accounts might monitor user activity or use the accounts for further illegal purposes. Exposed email addresses enable criminals to create targeted phishing attacks to achieve their goals of getting more personal details from victims.
For those who rely on VPN services for anonymity, the deanonymization of their identity will expose them to even more unique risks. An IP address that is tied to a user’s account may allow people to locate that user at their home or place of work based on their internet usage alone. This information could undermine the very privacy protections that VPN users seek.
Moreover, the correlation of user activity with exposed IP address information poses an additional type of privacy and security risk as well. The combination of this information with other data from previous data breaches could allow attackers to create in-depth and detailed profiles of their victims. These detailed profiles are highly useful in launching very sophisticated follow-up attacks against those users.
VPN Providers Trusted with Sensitive Information
VPN services occupy a position of high trust with their subscribers. Most users view them as means for protecting their location and movement from any spying or monitoring by ISPs or others. A data breach like this seriously damages that trust and exposes the users to a significant risk to their online security.
Dash VPN and FreeVPN, two VPN services, which are operated by ActMobile, provide services focused on privacy. This alleged data breach shows that even companies whose primary focus is on protecting users’ online privacy can also be victims of their online privacy via cyberattacks. Security experts agree that no company is completely immune to attacks by a very determined individual or criminal groups.
However, smaller and mid-sized firms often face the greatest challenges in building adequate defenses, a vulnerability that has become a growing concern for businesses across Singapore.
Exposed password hashes, though without the actual password, are also a risk for the user, as criminals can easily crack passwords that are weak or too common using brute-force methods. Users who created and are using unique, strong passwords are less likely to suffer from such exposed credentials.
However, in the event that the user should experience this type of exposure to their credentials, it is still best to follow the advice of security researchers. They recommend immediate change of password and the use of multi-factor authentication wherever possible. These simple steps can prevent account takeover even when credentials appear in breach data. Users should also avoid reusing passwords across different services.
Dark Web Markets Continue to Trade Stolen Data
The ongoing trend of cybercriminals trafficking in stolen credentials has continued to grow, with a surge in activity targeting companies providing privacy-oriented services.
As fraudsters exploit this data by selling it in dark web marketplaces, conditions have allowed for cybercriminals to profit from selling stolen personal data in these underground markets. Also, prices for the data change based on the perceived value of the information.
Although law enforcement agencies have made significant efforts in dismantling dark web marketplaces, new dark web platforms continually emerge, and cybercriminals will continually change the way they conduct business to avoid detection. Due to the ongoing development of the underground economy, law enforcement must continue to operate effectively to combat this rapidly changing environment.
The ActMobile incident adds another name to the growing list of companies that have suffered an exposure of their users’ information on dark web forums. Cybercriminals from all industries are continuing to target organizations for valuable personal information. The number of these types of incidences show that having strong security measures is vital.
Security experts recommend that individuals monitor their accounts for suspicious activity and consider using identity theft protection services. Early detection of unauthorized activity can limit the damage from credential exposure, and vigilance remains the best defense against the consequences of data breaches.
