945 Websites Hacked – up to 14 Million Potential Victims

Lucy Security uncovers collection of SQL databases leaked to the dark web from 945 websites all over the world

Austin, TX, Monday, June 29 2020 – A boutique hotel in Kathmandu, a Raspberry Pi tutorial blog, a photographer from Chelsea or an EMS service provider – according to Lucy Security’s Dark Web research team, 945 Websites worldwide have been hacked.

Archived SQL files stolen from 945 websites are being offered on the dark web, with tens of millions of potential victims. Information that is now publicly available includes usernames, full names, phone numbers, hashed and non-hashed passwords, IP and email addresses as well as physical addresses.

Two databases totaling approximately 150gb of unpacked SQL files were released on June 1st, 2020 and on June 10th, 2020 respectively. Apparently, all of the sites were hacked by different actors.

As if this wasn’t alarming enough, this might be only the beginning: The entity who collected and shared the databases on the dark web claims to have gathered these so-called “private” databases without having committed any hacking by themselves, yet they also claim to possess even more databases, which they are planning to share or sell to the highest bidder.

The websites were targeted, according to Lucy Security, according to their Alexa Ranking (https://www.alexa.com/siteinfo) They all have less than one Million visitors.

Does this latest hack have anything to do with the infamous Collection #1?
According to the analysis conducted by Lucy’s researchers, this is an entirely new threat; none of the databases were known to the public before.

The leaked databases, entire SQL dumps of the sites in question dated between 2017 and 2020, contain up to 14 million possible victims. Sensitive information found by Lucy includes security awareness statistics usernames, full names, phone numbers, hashed and non-hashed passwords, IP and email addresses, physical addresses and other information. Among the sites affected are 14 governmental sites belonging to Ukraine, Israel, UK, Belarus, Russia, Lebanon, Rwanda, Pakistan and Kyrgyzstan.