Actor 'Erich' claims live access to conference-space company support panel, with 6,027 users and 115,948 attachments
An actor using the handle Erich claims to have breached an unnamed conference-space company with an estimated $80-100 million in annual revenue. The actor says the compromise came through a support panel and that access is still active. The post cites 24,753 tickets, 387,388 comments, 274,294 system notes, 113,094 real replies, 115,948 attachment rows and 6,027 users. The breach, the continued access, the dataset contents and the client associations have not been independently verified, and the target company is not named.
Detalhes técnicos
- Claimed user records: email addresses (all 6,027 users), email-header data, first and last names, company IDs and names, department and location fields, last-seen timestamps, IP addresses and user-agent fields, ticket and reply counts, and language and deactivation fields.
- The actor says no attachment files were downloaded but that access to them remains available. A quick review of about 1,000 files reportedly showed debug logs and some NATO-related material from 2018.
- The actor names European institutions, international organizations, national governments, parliaments, public-sector bodies, AV integrators, distributors, manufacturers and enterprise clients as customers of the victim. The screenshot does not show that any of these were directly compromised.
- No victim domain, malware hash, Tox ID, Telegram handle or attacker IP is visible in the supplied material.
- The source maps the activity, as inferred rather than verified, to T1213 (Data from Information Repositories) and T1119 (Automated Collection).
Remediação
The article gives no remediation guidance. The victim is unidentified, so defenders cannot yet act on specific indicators. Organizations that use conference or AV support platforms should watch for notifications from their vendors and treat support-ticket content, attachments and contact data as potentially exposed until the claim is confirmed or refuted.
Linha do tempo
-
Actor 'Erich' claims live access to conference-space company support panel, with 6,027 users and 115,948 attachments
ler a análise desta fonte ocultar
An actor using the handle Erich claims to have breached an unnamed conference-space company with an estimated $80-100 million in annual revenue. The actor says the compromise came through a support panel and that access is still active. The post cites 24,753 tickets, 387,388 comments, 274,294 system notes, 113,094 real replies, 115,948 attachment rows and 6,027 users. The breach, the continued access, the dataset contents and the client associations have not been independently verified, and the target company is not named.
Technical Details
- Claimed user records: email addresses (all 6,027 users), email-header data, first and last names, company IDs and names, department and location fields, last-seen timestamps, IP addresses and user-agent fields, ticket and reply counts, and language and deactivation fields.
- The actor says no attachment files were downloaded but that access to them remains available. A quick review of about 1,000 files reportedly showed debug logs and some NATO-related material from 2018.
- The actor names European institutions, international organizations, national governments, parliaments, public-sector bodies, AV integrators, distributors, manufacturers and enterprise clients as customers of the victim. The screenshot does not show that any of these were directly compromised.
- No victim domain, malware hash, Tox ID, Telegram handle or attacker IP is visible in the supplied material.
- The source maps the activity, as inferred rather than verified, to T1213 (Data from Information Repositories) and T1119 (Automated Collection).
Remediation
The article gives no remediation guidance. The victim is unidentified, so defenders cannot yet act on specific indicators. Organizations that use conference or AV support platforms should watch for notifications from their vendors and treat support-ticket content, attachments and contact data as potentially exposed until the claim is confirmed or refuted.