Incident Details
Hackers who have chosen to remain unidentified are in the process of selling a collection of 160 million customer data records from 23 insurance companies in Iran, with an asking price of around $75,000. The authenticity of this data has been verified by the Iranian Leakage Tracking System known as Leakfa, which has stated that the information was accessed through a security breach within the Expert Information Technologists (Fanavaran) company’s network. The data for sale on the dark web includes personal details like names, national identification numbers, dates of birth, addresses, postal codes, and mobile phone numbers - all of which could potentially be used for fraudulent activities. The breach was initially reported by a Telegram channel in August.
Incident
How Did the Breach Happen?
There was a security breach in the infrastructure of the company known as Expert Information Technologists (Fanavaran).
What Data has been Compromised?
The data that was breached consists of information like full name, identification number, date of birth, home address, postal code, and cell phone number - all of which could be used for potential identity theft.
Why Did the company's Security Measures Fail?
The information does not specify the causes of the security measures failure within the company.
What Immediate Impact Did the Breach Have on the company?
The information provided does not specify the direct effect of the breach on the company.
How could this have been prevented?
The information provided does not include any details regarding the preventive measures for this security breach.
What have we learned from this data breach?
The information does not detail the insights gained from this data breach.
Summary of Coverage
Hackers operating under the guise of anonymity have successfully acquired and are currently distributing 160 million customer data records sourced from 23 insurance companies in Iran. This breach was facilitated through the systems of the company Expert Information Technologists (Fanavaran). The stolen information encompasses personal data that may be exploited for identity theft purposes.