15 million Trello users at risk after unknown hacker uses proxy service to scrape data — emails, usernames, full names and other accounts info are available for sale on hacking forum
A threat actor has put some 15 million people at risk by managing to link their private email addresses with public data from their Trello accounts.
A hacker with the alias “emo” took to a popular hacking forum recently, where they offered a database of more than 15 million Trello members for sale.
“Contains emails, usernames, full names and other account info. 15,115,516 unique lines,” BleepingComputer cited the ad. “Selling one copy to whoever wants it, message on me on-site or on telegram if you’re interested.”
Abusing APIs
Trello has now came forward with a statement, saying its systems were not breached, and that the information in the database was public and scraped.
“All evidence points to a threat actor testing a pre-existing list of email addresses against publicly available Trello user profiles,” Trello’s owner, Atlassian, said in a statement.
“We are conducting an exhaustive investigation and have not found any evidence of unauthorized access of Trello or user profiles.
However, this might not be entirely correct. Emo told the media that they used a publicly exposed API to link email addresses to public Trello profiles.
The API was designed to allow developers to query for public information on people’s profile, based on Trello IDs and usernames, but emo found that emails can also be queried this way, effectively associating public profile information to an email address which would, otherwise, remain hidden. The API was publicly accessible, the hacker added. Now, it requires users to log in, but a free account will suffice.
The problem here is that hackers can now know which email address was used to create a Trello account, information which can be abused in targeted and highly sophisticated phishing attacks. Knowing that Trello is a project management board used mostly by professionals only makes it more dangerous.
More from TechRadar Pro
A threat actor has put some 15 million people at risk by managing to link their private email addresses with public data from their Trello accounts. A hacker with the alias “emo” took to a popular hacking forum recently, where they offered a database of more than 15 million Trello…
