No, thank you: Shukran hack a reminder financial details not essential for fraud

详细摘要

The perpetrators of this week's data breach of Landmark Group's loyalty programme Shukran may have gained only basic user information, but that could be enough to commit more…

The perpetrators of this week's data breach of Landmark Group's loyalty programme Shukran may have gained only basic user information, but that could be enough to commit more damaging fraudulent activity.

On Wednesday, the Dubai-based conglomerate said it was investigating a cyber incident involving “unauthorised access” to Shukran, involving customer names, contact details and dates of birth. Shukran's initial assessment on its website remained unchanged on Saturday.

Analysts caution that this type of data could be used to create convincing impersonation scams, phishing messages and other forms of social engineering in which a victim is coerced to reveal sensitive information.

“The key concern is that a data breach does not need to involve financial information to create opportunities for financial fraud,” Mohamed Emam, a security researcher at Singapore-based cybersecurity firm Group-IB, told The National.

“Even when financial information is not compromised, exposed customer names and phone numbers can still be valuable to cybercriminals.”

After information has been extracted from a compromised system, it has the potential to travel very quickly through the dark web – in mere minutes with some reports even claiming instantly – including in cybercrime forums, illicit marketplaces and private messaging channels.

“Stolen information can circulate rapidly within cybercriminal communities. Depending on the nature of the breach and the attacker's intentions, compromised data may be offered for sale or shared on underground forums within hours of being obtained,” Mr Emam said.

“However, not every breach results in immediate publication or sale. In some cases, attackers may retain the information for their own operations or distribute it privately.”

Stolen data “can also be combined with information obtained from previous breaches to build more detailed profiles of individuals”, Maher Yamout, a lead security researcher at Kaspersky, told The National.

文章开头，摘自The National。如需阅读全文，请前往媒体网站。