Sign in / up

back to article Krebs: Lexis-Nexis, D&B and Kroll hacked

Major data aggregators have been compromised “for months”, according to prominent security blogger Brian Krebs, including Lexis-Nexis and Dun & Bradstreet. Writing at Krebsonsecurity, Krebs says the ID theft invasion of the brokers' servers dated back at least as far as April this year, and that “the miscreants behind this ID …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. An0n C0w4rd

    Big targets

    Data aggregrators are big targets because pwnage allows access to lots of data that would otherwise take a lot more pwned targets to find.

    The fact that these places got pwned (again) is not a surprise. Humans work there, and spear phishing is a popular sport amongst miscreants and is proven (repeatedly) to be highly effective. The fact that someone, possibly one of the sysadmins if they got access to the databases, fell for it is concerning as they are in the "should know better" category.

    The fact that they were pwned for months and didn't know is only mildly surprising.

    These places need to learn some real security.

    3 0
  2. Thomas Allen

    Key here is that (in the US) the D&B and LexNex databases are used to authenticate business clients before deals, and that banks use the data to vet businesses and individuals for lines of credit and before underwriting business deals. A common phrase before a deal is, "send us your D&B."

    The stolen database info allows 3rd parties to pose as authenticated and trustworthy business partners, and to pose as creditworthy banking clients.

    0 0
    1. Tom 13
      Reply Icon

      Re: allows 3rd parties to pose as authenticated and trustworthy

      Depending on the sophistication of the breach, it might also allow them to monitor the number and types of inquiries legitimate companies are making. That could be used to improve your trading positions in the securities markets with less risk of exposure than direct fraud.

      Either way, despite my other humorous post, this is cause for concern for all of us.

      0 0
  3. Tom 13
    Trollface

    Whew! D&B = Dun & Bradstreet

    So I'm safe then.

    If it had been Dave & Busters I'd be more concerned.

    1 0
  4. Anonymous Coward
    Anonymous Coward

    After effects

    What does this mean for 3rd parties that connect into the D&B or LexNex services? How does the botnet propagate? Are 3rd parties, with direct connectivity, at risk? Shame this article is a bit lite on the implications.

    0 0
    1. FrankAlphaXII
      Reply Icon

      Re: After effects

      Go ask Brian Krebs himself, he actually reads worthwhile comments on his blog, and generally if he can tell you something you want to know, he will. Keep in mind though sometimes he can't, he's a security researcher with contacts throughout the business, IT, Security and Intelligence communities so keep that in mind.

      Id imagine that third parties might be compromised too, for the moment I would safely assume that any system connected to D&B or Lexis-Nexis is potentially unsecure and should be treated as such. Which really sucks if you have to work with their products.

      0 0
This topic is closed for new posts.

Other stories you might like