- A threat actor using the alias Lucy is selling data allegedly stolen from Netim.com, including 16.5 million Elasticsearch documents and customer records.
- The alleged data includes source code, SSL details, configuration files, and customer information.
- The claims remain unverified, and Netim has not publicly addressed the alleged breach.
An underground seller operating under the handle Lucy has put Netim.com, a French domain registration and web hosting company, up for sale on dark web forums. The hacker wants $5,000 in cryptocurrency for what they describe as a complete data package.
The seller states that the entirety of the stolen data consists of approximately 16.5 million Elasticsearch records, including payment information, sale transactions, domain names, help desk tickets, hosting plans, affiliate data, SSL certificates and employee information.
The listing also mentions a database extract with detailed customer profiles containing names, physical addresses, telephone numbers, email accounts, hashed passwords, account funds, and VAT records, all current through the past two years.
The seller also points to SQL exports from payment, hosting, and live systems, plus the company’s full code base with settings, login details, and network maps.
The hacker stated that they would release data previews only after verifying a buyer’s ability to pay. The claims have no independent confirmation, and Netim has not issued any public response to the incident.
Critical Severity and Potential Impact
Security researchers view this listing as critical due to the role of Netim as a hosting provider and domain registrar. The claimed data involves both customer records as well as Netim’s own systems. If true and not just an elaborate scam, the customer data could enable identity theft, financial fraud, and credential stuffing.
The infrastructure-side material, including SSL certificate records, code with hardcoded keys, system settings, and internal network diagrams, opens the door for domain theft, eavesdropping on secure communications, and attacks on clients’ hosted sites. Because registrars sit at the root of domain and certificate trust, a breach of this kind can cascade to the provider’s entire customer base.
The database only goes up to two years ago, suggesting the information could be stale or reused from a past breach. However, even older data can remain valuable to criminals, especially when combined with other leaked information.
The listing presents the data as an exclusive, single-buyer deal. This approach typically suggests that the hacker is attempting to generate the most profit from a single buyer rather than multiple buyers. The $5,000 price tag also indicates that the seller perceives this data to hold a great deal of value.
The lucrative nature of such data sales has drawn international attention. The US Justice Department has announced major actions against Southeast Asian scam centers that profit from similar cybercriminal activities.
What the Alleged Data Includes
The hackers claim that the Elasticsearch cluster holds 16.5 million documents from Netim’s daily operations. This massive pile of data includes payment records, sales logs, domain registrations, and support tickets. It also contains hosting setups, affiliate details, SSL certificates, and internal staff accounts.
The stolen database dump apparently exposes master customer records. The files include personal information, such as full name, home address, telephone number and email address. Also, hashed passwords, current account balances, and VAT numbers are part of the records. Data of this type are great treasure for cyber-criminals, as it allows them to easily commit identity theft and financial fraud.
Furthermore, SQL dumps from the billing, hosting, and production systems add another layer of risk. The leak also features complete source-code repositories that contain configuration files, login credentials, and internal network layouts. These technical files worry experts the most. They could expose deep vulnerabilities in Netim’s systems and give future attackers a perfect roadmap to launch new intrusions.
The presence of SSL details raises major red flags too. Normally, SSL certificates encrypt the traffic between websites and regular users to keep data safe. If attackers steal these certificates, they can potentially intercept or decrypt your private online communications.
Response and Prevention
Netim has not yet released a public statement about this alleged data breach. Due to the lack of information from them directly, customers need to take protective actions against any unusual transactions or unauthorized activities on their accounts. Immediately change your password and enable Two-Factor Authentication to help prevent hackers from accessing your account using stolen login credentials.
Domain registrars and hosting companies look after some of the most sensitive data on the internet today. When hackers successfully breach a provider like this, the damage ripples outward. It harms the company itself, but it also creates massive security problems for every single customer on their network.
This event reflects the need for tech companies to use robust security measures to protect domains and hosting services. A company could significantly reduce the risks associated with cyber-attacks by conducting frequent security audits, training personnel, and implementing reasonable limits on access to systems and networks.
Right now, nobody has independently verified these hacking claims, so the data might be old or completely fake. Even so, the potential damage of this leak is simply too big for Netim or its customers to ignore.
