Actor "skra" claims 18 TB exfiltrated from Kensium, releases ~170 GB of source code and AWS database backups
An actor using the handle skra claims to have exfiltrated more than 18 TB of data from Kensium, a Chicago-based IT services and digital agency specializing in ERP-connected e-commerce solutions. The current release is said to contain nearly 170 GB of source code and recent database backups taken from AWS S3 and EC2-hosted infrastructure, with further batches announced over time. Listed data categories are source code, personally identifiable information and database backups, spanning what the actor describes as the company's network and cloud infrastructure, including ERP, WMS and POS-connected environments. Dark Web Informer states it has not independently verified the breach, the claimed volume, the archive contents or the PII exposure; the evidence is limited to a screenshot of the actor's listing, which does not expose the file tree or archive contents. No vendor statement from Kensium on the claim was found on its public channels at the time of writing, and no malware hash, Tox or Session ID, Telegram handle or attacker-controlled IP is visible in the supplied material.
Detalhes técnicos
The listing points to cloud-side collection rather than an exploited vulnerability: references to recent database backups from AWS S3 and data tied to EC2 instances map to T1530 (Data from Cloud Storage), while the claimed source-code archive maps to T1213.003 (Code Repositories). Both mappings are analytical inferences from the listing, not confirmed tradecraft; the initial access vector, dwell time and acquisition path are unknown. If authentic, source-code and backup exposure raises the risk of hardcoded credential and secret leakage, application-security analysis by attackers, intellectual-property loss and follow-on intrusions against integrated customer ERP, WMS and POS systems.
Remediação
Organizations integrated with Kensium-delivered e-commerce or ERP environments should treat shared credentials, API keys and service accounts as potentially exposed, rotate them, and review AWS CloudTrail, S3 access logs and IAM activity for anomalous access or bulk download patterns. Enforce MFA on cloud consoles, restrict S3 bucket and snapshot permissions, and monitor for the appearance of further batches claimed by the actor.
Linha do tempo
-
Actor "skra" claims 18 TB exfiltrated from Kensium, releases ~170 GB of source code and AWS database backups
ler a análise desta fonte ocultar
An actor using the handle skra claims to have exfiltrated more than 18 TB of data from Kensium, a Chicago-based IT services and digital agency specializing in ERP-connected e-commerce solutions. The current release is said to contain nearly 170 GB of source code and recent database backups taken from AWS S3 and EC2-hosted infrastructure, with further batches announced over time. Listed data categories are source code, personally identifiable information and database backups, spanning what the actor describes as the company's network and cloud infrastructure, including ERP, WMS and POS-connected environments. Dark Web Informer states it has not independently verified the breach, the claimed volume, the archive contents or the PII exposure; the evidence is limited to a screenshot of the actor's listing, which does not expose the file tree or archive contents. No vendor statement from Kensium on the claim was found on its public channels at the time of writing, and no malware hash, Tox or Session ID, Telegram handle or attacker-controlled IP is visible in the supplied material.
Technical Details
The listing points to cloud-side collection rather than an exploited vulnerability: references to recent database backups from AWS S3 and data tied to EC2 instances map to T1530 (Data from Cloud Storage), while the claimed source-code archive maps to T1213.003 (Code Repositories). Both mappings are analytical inferences from the listing, not confirmed tradecraft; the initial access vector, dwell time and acquisition path are unknown. If authentic, source-code and backup exposure raises the risk of hardcoded credential and secret leakage, application-security analysis by attackers, intellectual-property loss and follow-on intrusions against integrated customer ERP, WMS and POS systems.
Remediation
Organizations integrated with Kensium-delivered e-commerce or ERP environments should treat shared credentials, API keys and service accounts as potentially exposed, rotate them, and review AWS CloudTrail, S3 access logs and IAM activity for anomalous access or bulk download patterns. Enforce MFA on cloud consoles, restrict S3 bucket and snapshot permissions, and monitor for the appearance of further batches claimed by the actor.