Samsung Germany has fallen foul to a colossal contact center data breach, with 270,000 customer service tickets leaked.
Many hacks and breaches come from sophisticated exploits or an insider.
However, on this occasion, the breach can be traced back to credentials stolen in 2021 and sourced from samsung-shop.spectos.com
According to Hudson Rock, this specific breach relates to a previous issue where "Raccoon Infostealer malware silently harvested login credentials" from an employee of Spectos GmbH.
Spectos GmbH monitors and enhances service quality and is integrated with Samsung's German ticketing platform at samsung-shop.spectos.com.
These credentials sat dormant until "GHNA" - the alias behind the hack - accessed them.
Back to the present, over a quarter of a million customer tickets were uploaded to the open internet, free of charge - all due to a login that wasn’t rotated.
On the breach, Alon Gal, Co-Founder and CTO at Hudson Rock, explained: "[Hudson Rock] flagged these compromised credentials years ago in our Cavalier database, which tracks over 30 million infected machines.
Samsung could’ve acted, but they didn’t, and now the damage is done.
The Leak Is an Ocean of Sensitive Data
The 270,000 tickets are an extensively detailed "shopping list" for hackers accessing Samsung Germany’s customer base and include the following:
Personal Identifiable Information (PII):
Alarmingly, a range of PII, including full names, email addresses, and home addresses, was released.
Transaction Details:
Additional leaks included order numbers, model numbers, payment methods, and Tracking URLs.
Support Interactions:
The support interactions that leaked included:
- Ticket IDs
- Agent emails
- Issue descriptions
- Vendor responses
This Isn’t Samsung's First Rodeo With Cybersecurity Issues
Readers don't need to think back far - just to 2023 - to remember the news of Samsung employees accidentally leaking sensitive code through ChatGPT.
This led to a company-wide ban on using generative AI to avoid repeated mistakes.
Speaking to SC Media after the news broke, Chad Cragle, Chief Information Security Officer at Deepwatch, explained: "The Samsung Germany breach is a textbook example of the long tail of credential-based threats.
