Whoosh confirms data breach after hackers sell 7.2M user records

The Russian scooter-sharing service Whoosh has confirmed a data breach after hackers started to sell a database containing the details of 7.2 million customers on a hacking forum.

Whoosh is Russia’s leading urban mobility service platform, operating in 40 cities with over 75,000 scooters.

On Friday, a threat actor began selling the stolen data on a hacking forum, which allegedly contains promotion codes that can be used to access the service for free, as well as partial user identification and payment card data.

The company confirmed the cyberattack via statements on Russian media earlier this month but claimed that its IT experts had managed to thwart it successfully.

In a new statement shared with RIA Novosti today, Whoosh admits that there is a data leak and informs its user base they are working with law enforcement authorities to take all measures to stop the distribution of the data.

“The leak did not affect sensitive user data, such as account access, transaction information, or travel details,” stated a Whoosh spokesperson.

“Our security procedures also exclude the possibility of third parties gaining access to full payment data of users’ bank cards.”

What’s for sale

On Friday, a user on the ‘Breached’ hacking forums posted a database containing details about 7.2 millionWhoosh customers, including email addresses, phone numbers, and first names.

The database also contained partial payment card details for a subset of 1,900,000 users.

The seller also claimed that the stolen data included 3,000,000 promo codes, which people can use to rent Whoosh scooters without paying.

The seller says they are selling the data to only five buyers for $4,200 each, or .21490980 bitcoins, and according to the SatoshiDisk platform used for the transaction, no one has yet to purchase the database.

In a separate sale of the data on Telegram, the threat actor claims it was stolen during a November 2022 attack on Whoosh.

Russian database leaks

According to an August 2022 report from Roskomnadzor, Russia’s internet watchdog, there were 40 confirmed Russian company data breaches since the beginning of the year.

In September 2022, Group-IB published a report claiming to have observed 140 database sales stolen from Russian companies this summer alone, with the total number of exposed records reaching 304 million.

The most notable leak, in terms of its impact this year, was that of the food delivery app Yandex Food, which led to multiple collateral data exposures.

Source: https://www.bleepingcomputer.com/news/security/whoosh-confirms-data-breach-after-hackers-sell-72m-user-records/