Drivesure, a car dealership service provider, suffered a data infringement last December that resulted in 26GB of personal information being downloaded and shared on hacking forums. The data set that was hacked contained names as well as addresses and phone numbers of 3.2 million customers as well as text messages and emails between buyers and sellers vehicles, VINs of their vehicles and service records. More than 93, 000 Bcrypt hashed passwords were made public. While bcrypt hashes are considered superior to traditional methods such as SHA1 and MD5 however, they are still able to be brute forced following download, as reported by Risk Based Security.

In a lengthy virtual collaboration software blog post on Raidforums, hacker « pompompurin » provided details of the leaked user’s information and files. This is unusual since hackers typically share only important segments or trimmed down versions of the databases they have discovered.

According to CISO Magazine, the database was exposed due to a mistake in an AWS bucket used by the company. The AWS bucket was left unprotected for a period of time and anyone was able to access the database and its contents, including more than a million unique email addresses, and passwords that were stored in plaintext and secured using the bcrypt.

The breach is a significant worry for those who utilize drivesure because they are at risk of becoming victims of identity theft or fraud if their personal details are stolen. Users of the site should change their passwords immediately. Also, they should think about changing their login credentials on other websites which use the same credentials.