The attack seems to be a retaliatory effort from Killnet following the diplomatic tensions between the two countries.
Pro-Russia threat actors Killnet have targeted Lithuania government institutions and networks in a series of highly disruptive DDoS attacks (distributed denial of service attacks). The country’s National Cyber Security Center (NKSC) confirmed the attack impacted the Secure National Data Transfer Network and private and public sector firms.
This “intense” attack occurred on 27 June 2022 and prevented users from accessing services. Although the attack has been managed now, and most of the sites are back online, the possibility of another attack cannot be ignored.
“It is highly probable that such or even more intense attacks will continue into the coming days, especially against the communications, energy, and financial sectors.”
Jonas Skardinskas – Director NKSC
The Bone of Contention- Kaliningrad
The attack seems to be in reaction to the diplomatic row between Russia and Lithuania regarding the Russian exclave of Kaliningrad. For your information, it is situated on the Baltic Sea shores and was previously a part of Germany before WWII and then a part of the Soviet Union. Kaliningrad was later cut off from Russia after Lithuania became independent in 1990 as there were no ground routes.
After Russia’s invasion of Ukraine, Lithuania supported the EU ban on Russian exports after it was implemented across EU territories and blocked the transport of key materials like metals, coal, and construction materials to Kaliningrad, infuriating the Kremlin.
[wp-ad-camp-1]
Killnet Response
The Russia-aligned hacktivist group Killnet claimed responsibility for the DDoS attack in a video and added that the group would again target the country until it lifted the blockage on Russian exports.
The group’s spokesperson told Reuters that Killnet demolished 1,652 web resources and plans to cause more damage soon. As seen by Hackread.com, Killnet is currently active on Telegram posting a list of Luthinian sites targeted by the group. In one of its statements in the Russian language, the group claimed the following:
In 39 hours, we achieved the isolation of 70% of the entire network infrastructure in Lithuania. I will explain on the fingers: Web integration of Lithuanian websites and electronic systems is in the “Blockade”, that is, “Geo block”, web traffic and other means of communication are available only within the republic. Thus, we are disrupting Lithuania’s network interaction with the rest of the world. At the moment, Lithuania is in sadder conditions than Kaliningrad. And we keep our promise! 😉
Impact of the Attack
Lithuania’s government stated that the DDoS attack flooded several institutions’ websites with malicious traffic. Some of the websites taken down by Killnet include Lithuania’s State Tax Inspectorate (STI) and the country’s leading accounting services provider B1.lt among others.
[wp-ad-camp-1]
The attack disrupted the Secure National Data Transfer Network, which is among the most critical components of the country’s national security in the cyber world, particularly during wartime. Lithuania’s Core Center of State Telecommunications is currently identifying the impacted sites to offer DDoS mitigation.
Killnet on Telegram
Previous Coverage
Killnet angered the hacktivist collective Anonymous after declaring allegiance to Russia after the latter invaded Ukraine and started a war. Since the allegiance, Killnet has been active on its Telegram channel ‘We Are Killnet.’
Flashpoint researchers observed chats between the group members in which they mentioned a large-scale, coordinated attack on June 27 2022, which they referred to as Judgment Day.
The attackers selected Lithuania as its target for closing transit routes to Kaliningrad. The group has also targeted European institutions. Hackread.com previously reported that the group leaked the private info of Killnet hacktivists in a data dump and took the group’s website Killnet.ru offline.
There is some uncertainty about whether a vulnerability in Ivanti Sentry is being exploited in the wild, but why take the risk when you can patch?
Ivanti has published a security blog post about a vulnerability in Ivanti Sentry, formerly MobileIron Sentry. Successful exploitation of the vulnerability would enable an unauthenticated attacker to access some sensitive APIs that are used to configure Ivanti Sentry on the administrator portal (commonly, MICS).
Ivanti Sentry is a gateway technology that allows organizations to manage, encrypt, and protect traffic between mobile devices and backend systems. The technology helps organizations to securely access enterprise applications and devices using personally owned and corporate-issued mobile devices.
This vulnerability impacts all supported versions (Versions 9.18. 9.17 and 9.16). Older versions are also at risk. This vulnerability does not affect other Ivanti products or solutions, such as Ivanti EPMM, MobileIron Cloud or Ivanti Neurons for MDM.
Ivanti has made RPM scripts available now for all supported versions. It recommends customers first upgrade to a supported version and then apply the RPM script specifically designed for their version. More detailed information is available in this Security Advisory. Each script is customized for a single version and if the wrong RPM script is applied it may prevent the vulnerability from being remediated or cause system instability.
The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The CVE patched in this update is CVE-2023-38035, which has a CVSS score of 9.8 out of 10. It’s described as a security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
A remote, unauthenticated attacker could exploit this vulnerability to change configuration files, run system commands, or write files to the system.
Reportedly, Ivanti customers have seen exploitation of CVE-2023-38035 in Sentry when port 8443 is exposed to the Internet. Port 8443 is commonly used for HTTPS (encrypted) web traffic. Users that are not ready to update to a supported version or don’t have the opportunity to run the script, are advised to close port 8443.
Ivanti recommends that customers restrict access to MICS to internal management networks and not expose this to the internet, which would then require any attacker to gain internal access first.
While we are not completely sure if this vulnerability is used in the wild, two previous vulnerabilities in Ivanti Endpoint Manager Mobile Authentication (EPMM) listed as CVE-2023-35078 and CVE-2023-35081were both subject to active exploitation.
We don’t just report on vulnerabilities—we identify them, and prioritize action.
Google might not be axing its smart glasses project after all, but it might take a different turn to make the product available. The tech giant might be on the lookout for a partner to work with for the development and launch of this product. Working with a partner will mean sharing ideas both on the hardware and software of the pair of smart glasses.
For a few years, the internet has been expecting the launch of the Google smart glasses. This product was not just hearsay or the mere speculations of some popular tipster. Google had shown off this product and given fans hope of its existence to the point of showcasing its functionality during an event.
However, just a few months ago, Google visited the smart glasses project with their infamous axe, bringing its existence to an end. Well, it now seems like Google did not finish the project off entirely, as they are now looking for a partnership. According to recent reports, the smart glasses aren’t dead but will bring a partnership between Google and another company.
Google smart glasses might launch in 2025 with an impressive microLED display and software features
Ever since its inception, Google smart glasses have seen a lot of challenges. Most people say that these challenges are internal problems that teams working on this project have to face. These include leadership changes and an unclear vision for the final product.
For this reason, Google had to end the project and focus its attention on other things. One of the areas they turned their attention to is the XR industry. Google and Samsung are now partnering up to create a pair of XR glasses that will run on Android software.
Working with Samsung on this project will mean that Samsung gets the hardware ready and Google perfects the software. This might also be the case with the smart glasses that Google’s fans have been expecting. By partnering with another company, Google might get to focus on perfecting the software this product will run on.
However, reports also have it that Google is working on the glasses’ display technology. These might be microLED screens and will be designed by Raxium, a company Google now owns. While some hardware aspects of this project are on hold, the software development is still on throttle.
Google aims to launch this pair of smart glasses by 2025, bringing tech in front of users’ eyes. Once available, this product will bring a new way to interact with your smart devices. More details on this product’s development will be made available in the coming months.
If you’re a Windows 11 user, you’ve certainly come up with some preinstalled apps after booting up the system. Most of these apps are quite useless, and some of them can’t even be uninstalled. However, the Redmond tech giant might soon loosen its rules for the preinstalled bloatware.
According to The Verge, Microsoft wants to finally allow Windows 11 users to remove some of the preinstalled apps that come with the operating system. The change has appeared in a new Windows 11 build in Canary Channel testers. The Camera app, the Cortana app, the Photos app, the People app, and the Remote Desktop (MSTSC) client are the preinstalled bloatware that you can soon remove from your system.
Microsoft has just killed Cortana, and removing its app from Windows 11 isn’t surprising. The other four apps are among the most useless apps that users might never open.
You can soon remove preinstalled Windows 11 apps
To be fair, some of the preinstalled apps that come with Windows 11 are useful for some specific purposes. Microsoft dubbed these “inbox apps” and believes they’re “essential to the overall Windows experience.” The company now lets users remove most of them by choice. The option is now available through Windows Insider builds.
These apps also don’t occupy too much space in your system. So don’t expect to free a considerable amount of space after removing them. The only benefit you get from removing preinstalled apps is probably having a trimmed and less crowded Start menu.
At the same time that Microsoft allows you to remove bloatware, it’s adding CPU, memory, and GPU monitoring widgets to Windows 11. These widgets might be handy for gamers, allowing them to check the system’s performance while playing. The GPU widget also lets you switch between different graphics cards if you’re using multiple GPUs.
Microsoft also plans to launch a major update for Windows 11 in September. The update might bring native support for RAR and 7-Zip files, more uninstallation options, a new settings homepage, etc.
Samsung has revealed when it plans to release the second One UI 6.0 beta update for the Galaxy S23 series. A moderator for the company’s South Korean community forum recently confirmed that the Beta 2 will arrive in late August or early September. The official didn’t reveal a precise date, though.
One UI 6.0, which is Samsung’s latest custom Android software (based on Android 14), is currently in open beta. The Korean behemoth launched the beta program for the Galaxy S23 series earlier this month. As expected, the first beta build is quite buggy. It isn’t completely unusable, but there are a few quirky bugs that affect the normal functioning of some critical features.
A Galaxy S23 user who has enrolled in the One UI 6.0 beta program recently took to Samsung’s community forum to flag some known issues. A moderator responded by saying that the company’s software team is already working on fixing those bugs. They added that you can expect fixes for some of them if not all with the second beta build, which will roll out later this week or next week.
Note that One UI 6.0 Beta 2 may not fix every single bug present in the initial release. Samsung will address the remaining issues with subsequent beta releases later. It is expected to roll out a few more beta updates in September and October. The stable rollout for the Galaxy S23 series may begin in late October or early November. We will keep you posted with all of these updates.
Samsung may expand One UI 6.0 beta to more countries
The One UI 6.0 beta program is currently available for Galaxy S23 users in only three countries: Germany, South Korea, and the US. However, Samsung later confirmed that the beta program will also launch in China, India, Poland, and the UK. While it didn’t reveal a timeline, we may see One UI 6.0 beta reach the latest Galaxy flagships in these countries alongside the Beta 2 release.
Samsung is also preparing to release One UI 6.0 beta for the Galaxy S22 series. It will eventually add more devices to the beta program, including its recent Galaxy Z series foldables and select Galaxy A series premium mid-range phones. If you’re using a compatible Samsung phone and live in a supported region, watch out for a One UI 6.0 banner in the Samsung Members app. If you see one, you should be able to enroll in the beta program from that banner.
While many workers see generative AI as a threat to their positions, IBM has a different opinion and believes workers should use AI to their advantage.
IBM has gathered the results of its research in a report, which is now available for everyone to read. The report assessed the impact of generative AI on business models, how companies will use AI for their operations, and the impact that AI has on roles.
According to the IBM study, nearly 40% of the workforce should reskill as a result of implementing AI and automation over the next three years. This means almost 1.4 billion out of the 3.4 billion people in the global workforce need to reskill due to AI and automation.
IBM also added AI won’t replace people. However, employees who know how to use and apply AI to business will replace those workers who don’t. So, if you’re an employee, instead of cursing AI, learn how to use it to develop your skills and apply it to your work operations.
Employees should not be afraid of AI, IBM says
IBM research consists of data from two prior studies, including 3,000 C-level executives across 28 countries and another of 21,000 workers in 22 nations. All evidence suggests that AI will significantly change the workforce, but you should not be afraid. Almost 87% of surveyed executives said they expect AI to augment roles instead of replacing them.
IBM continued that tech adopters who can successfully reskill to accommodate technology-driven job changes “report a revenue growth rate premium of 15% on average compared to other tech adopters.” Additionally, those who emphasize AI could “see a 36% higher rate of revenue growth than their peers.”
The report also sheds light on the essential required skills for the workforce and how AI resulted in a change. For example, proficiency in STEM was a high-priority skill in 2016, but it’s not that much required in 2023. Instead, time management and the ability to prioritize are now essential skills for every employee. Teamwork, communication skills, and flexibility are other high-priority skills.
If you’re into MMA in general, you’re in the right place, as we’ve rounded up our favorite MMA / UFC apps and games for Android. There are quite a few apps and games for MMA in the Play Store, but not all of them are good. In fact, finding really good apps / games for this category hasn’t been easy. Still, we’ve managed to come up with 9 options to present to you, and they’re listed below.
There are several apps listed below, along with quite a few games. Do note that these apps / games are not listed in any specific order. There’s something for everyone here, ranging from regular news apps, to 3D simulation games, and even live score apps, if that’s something that interests you. If you’d like to gain some MMA skills, that’s also something you can do thanks to one of the apps listed below.
Best MMA / UFC Android apps & games 2023 Downloads
Below is a little more information on each app, and a direct link for easy downloading.
All download links go to the app’s Google Play Store listing. Users are always recommended to download apps from Google Play or an authorized app store.
UFC
– Price: Free to download – In-app purchases: $1.00-$334.99 – Size: Varies with device – Google Play rating: 4.6 out of 5 stars
UFC is more or less an app alternative to the game we’ve talked about a minute ago. This is the official UFC application for Android, and it’s excellent. If you’ll download only one UFC app on your device, this should probably be it. Official applications for various competitions are not always the best choice, but that’s not the case here. This app has such a high rating in the Play Store for a good reason.
The app looks really nice. The UI is well thought-out. It’s simple, and yet contains a ton of information. You can easily jump from one side to the next thanks to navigation tabs on the bottom. You can stream live events via this application on a weekly basis, though do know that’ll require a UFC FIGHT PASS subscription. You can also get tons of news from the world of UFC, various stats, information, and more.
– Price: Free to download – In-app purchases: $2.49-$99.99 – Size: Varies with device – Google Play rating: 4.3 out of 5 stars
If manager games are your thing, well, there’s one such game for MMA as well, and it’s excellent. The game is called ‘MMA Manager’, which is easy enough to remember. This game will put you in a hot seat of a manager of your own gym. You’ll be able to hire top rated gym trainer and fight coaches in order to elevate your fighters. You can make them defensive-oriented, more offensive, and so on.
You can actually build your own gym here, and choose the equipment that goes into it. The better you do in fights, the more credit and prestige you’ll earn. You’ll also be able to climb the leaderboard as well. The graphics in this game is really, really nice as well, one of the best in a game of this caliber on Android. The game does have in-game purchases, but you’re not forced to act upon those.
– Price: Free to download – In-app purchases: No – Size: Varies with device – Google Play rating: 4.4 out of 5 stars
If you’re trying to gain some MMA skills, the MMA Trainer app can help you immensely. The best of all, this app is free to use. Ads are a part of the picture, but the same cannot be said for in-app purchases. Watching the official promo video above will give you a great idea as to what this app offers. You’ll be able to learn the exact move as the app will show it to you on a 3D model, as soon as you choose it to do so.
The developer says that this app is designed for both beginners and professionals, as its database of moves is quite vast. It will help you to sharpen your focus, balance, and technique, and on top of that, you’ll get a really nice workout out of everything. This is essentially a how-to app, but a really good one. There is also a slow-motion option to watch for every single detail, which can be helpful.
– Price: Free to download – In-app purchases: $4.99 – Size: Varies with device – Google Play rating: 4.0 out of 5 stars
Weekend Warriors MMA game is excellent, despite the fact its graphics seems to be quite dated. If you’re looking for great graphics, this is definitely not the game for you, but if you don’t care much about it, give it a shot. Weekend Warriors MMA game offers great controls, and it’s a really solid 3D game. This game offers 300 fighters, across 5 promotions, and 5 weight classes.
In the game, you can access a fully playable “Promoter” mode, or simply pursue the career mode. The developer really did do a good job with controls here, so even though you’ll learn them fast, mastering them will take some time. Do note that this game offers a ‘Pro’ subscription which will provide you with a lot of perks, and some additional content. The game itself is free to play, though.
– Price: Free to download – In-app purchases: No – Size: Varies with device – Google Play rating: 4.4 out of 5 stars
Martial Arts Master does deliver really solid graphics, even though it does trail behind EA SPORTS’ UFC title. That’s something you’ll soon forget, as this is a great game. If you like MMA, chances are you’ll enjoy this game. You’ll be able to earn points for each win in the game, and along the way, you’ll level up your fighter. With those points, you’ll be able to unlock new tournaments and characters.
The music in this game is also quite nice, and it follows the action in the ring. Do note that this is an offline-only game. The controls in the game are also quite nice. You’ll see various options on the display at all times, so that you can act fast, depending on what situation you’re in at the moment. If you’re looking for an alternative to what EA SPORTS’ title has to offer, try this one out.
– Price: Free to download – In-app purchases: $1.99-$99.99 – Size: Varies with device – Google Play rating: 4.0 out of 5 stars
Fighting Star is yet another really compelling 3D MMA game. This game delivers really nice graphics, and excellent animations. This game leans towards a simulation, so keep that in mind. The game will put quite a challenge in front of you, as it will require you to create a name for yourself in the ring, after starting as a nobody. Your ultimate goal is to become the world champion.
You’ll be able to customize your fighter with dozens of gloves, hairstyles, tattoos, and gear. Dip, dodge, and weave to avoid your opponent’s attacks, and then strike back to gain the advantage. There are various combos that you can take advantage of in this game, by the way. Fighting Star is definitely a game worth trying out, if you’re into MMA. It has a lot to offer, that’s for sure.
– Price: Free to download – In-app purchases: $0.99-$99.99 – Size: Varies with device – Google Play rating: 4.2 out of 5 stars
EA SPORTS UFC Mobile 2 is the company’s latest UFC game. First and foremost, it’s worth saying that this game offers some of the best graphics, counting in other games from this list. That being said, this is an official UFC game, hence you’ll be able to play with and against real fighters. You’ll even be able to engage in live content in-between actual UFC events, which is kind of unique to this game.
This game does offer an RPG layer as well, while you’ll compete to climb the leaderboards. You’ll also be able to utilize signature fight moves, and improve your fighters as you go along. You’ll be able to level up your fighters, and each of them will possess unique abilities. You can also win exclusive awards, and much more. There’s a lot of different content included in this game.
– Price: Free to download – In-app purchases: $0.99-$49.99 – Size: Varies with device – Google Play rating: 4.2 out of 5 stars
MMA Rivals is another game on this list, and a really interesting one at that. This game won’t try to wow you with its graphics, not at all. In fact, the graphics do look quite old, on purpose. This is a sports simulator, of sorts, but it focuses entirely on MMA. The game focuses on tactics and timing during a match. So, even though you’ll see the match itself, the focus will be on actions you can do during it. You won’t be controlling the fighter in real time, directly.
There are four different martial arts styles to choose from here, Boxing, Karate, Brazilian Jiu Jitsu, and Wrestling. This is a card battler of sorts, and you’ll improve your fighter’s skills along the way. You can also expand your deck, and built the number of variety of moves you can make. Do note that this game is still in development, though, and that the developer promised that more martial arts styles will be added.
– Price: Free to download – In-app purchases: No – Size: Varies with device – Google Play rating: 4.3 out of 5 stars
If you’re on the lookout for a news app for MMA sports, well, this is it. MMA News is exactly what you think it is. This app offers a really simple UI that focuses on the articles themselves. There is a simple menu at the bottom, and the main hamburger-style menu. That’s basically it. This app will pick up stories from a number of websites, such as mmamania, mmanews, mmaweekly, and even from some YouTube channels.
You can choose which sites to follow, of course, and you’ll be able to watch the latest MMA videos via this application. There is also an option to share your favorite article, and to share them with whomever you want, of course. That’s basically everything this app has to offer, try it out if you’re interested in MMA news.
PayPal claims that this was not a result of a breach in its systems, since no evidence suggests that the user credentials were obtained directly from them.
On Thursday, January 19th, 2023, PayPal began contacting nearly 35,000 users with a data breach notification, explaining that their accounts had been hacked between December 6th and 8th, 2022.
The company was able to detect and mitigate the attack as soon as it occurred, but the conclusive investigation was not finished until December 20th, 2022. At this point, they confirmed that the hackers had gained unauthorized access to the accounts using valid credentials.
PayPal claims that this was not a result of a breach in its systems, since no evidence suggests that the user credentials were obtained directly from them.
The hackers were able to access the accounts by using credential stuffing, whereby pairs of usernames and passwords sourced from data leaks are tried on various websites. With the help of bots, lists of credentials are inserted into login portals for various services. Users who employ the same password for multiple online accounts, known as password recycling, are most prone to credential-stuffing attacks.
According to the data breach notification by PayPal, 34,942 users have been affected by the incident. While unauthorized third parties had access to the accounts, they could view the following information about the account holders:
Full names
Dates of birth
Postal addresses
Social security numbers
Individual tax identification
According to Bleeping Computer’s report, transaction histories, connected credit or debit card details, and PayPal invoicing data are all accessible through the accounts, as well.
Screenshot: Bleeping Computer
PayPal claims to have taken quick action to limit the hackers’ access to the platform by resetting the passwords of all the affected accounts. Impacted users will receive a free, two-year identity monitoring service from Equifax.
PayPal further confirmed that the attackers did not attempt or manage to perform any transactions from the breached accounts.
“We have no information suggesting that any of your personal information was misused as a result of this incident, or that there are any unauthorized transactions on your account.”
– PayPal
In a conversation with Hackread.com, Jasson Casey, CTO at Beyond Identity said that “It’s no wonder the Verizon Data Breach Report 2022 found credentials were the most likely form of data to be compromised in both the US (66%) and EMEA (67%).
“If a threat actor can access legitimate credentials – even if they’re dumped in a dark web repository – they are only a few short, and in most cases, automated steps away from a successful intrusion,” Jasson added.
The CTO praised PayPal for its quick response and for mitigating the attack, but questioned whether merely changing passwords is the solution. “In this incident, the company is doing the best it can for its customers – strongly recommending they change their passwords. But passwords – whether unique or complex – are fundamentally flawed. More than 80% of data breaches are the direct result of passwords, with threat actors deploying compromised credentials in the first phase of their attack,” Jasson said.
How to secure your PayPal account
PayPal accounts are a great way to shop online and make payments, but this incident highlights the fact that they can also be vulnerable to hackers. It is important that PayPal users take steps to protect their accounts and personal information from potential theft.
To prevent unauthorized access, it is essential that PayPal users create a strong password with at least 8 characters and include a mix of numbers, symbols, upper-case letters, and lower-case letters.
It’s also recommended that users change the password periodically. Additionally, two-factor authentication (2FA) should be enabled on the account so that any suspicious activity will have an extra layer of security before it can be completed. Finally, users should check their accounts regularly for unusual activity or unauthorized transactions.
Using these tips can help ensure your PayPal account remains secure against potential threats or breaches.
AYANEO today has announced that it partnered up with Qualcomm for the Pocket S, the company’s upcoming Android handheld, which will be powered by Qualcomm’s Snapdragon G3x Gen 2 platform. If that platform sounds familiar, it’s because it’s been used in numerous other handhelds in the past. Though, in earlier versions.
The Razer Edge and Razer Edge 5G for example run on the Snapdragon G3x Gen 1. Announced this morning, Qualcomm’s new G3x Gen 2 has some promising advancements for the future of handhelds. With the potential to boost Android handheld gaming devices to new heights in terms of what they can deliver for a gaming experience. The AYANEO Pocket S will be at the forefront of that as one of the first devices to officially run on the Qualcomm Snapdragon G3x Gen 2 platform.
The AYANEO Pocket S will launch sometime in December of this year
If you take a second to look at your options, there’s a lot to choose from for handheld gaming devices right now. The Steam Deck, naturally, is one of the most well-known. Next to the Nintendo Switch of course. But there’s also things like the Logitech G Cloud and Razer Edge. As well as the ASUS ROG Ally, and quite a few handhelds from AYANEO and other brands GPD. Now AYANEO has another one to add to the list with the Pocket S. And it’s expected to launch sometime in December of this year. AYANEO hasn’t confirmed an exact launch date for the device yet though.
And beyond the announcement of its existence, the company hasn’t said much. Right now there’s no information on specs, price point, availability, or features. That being said, AYANEO did share a lot of images of the device. Which will apparently come in both Black and White colorways.
You can also glean a little bit about it by looking at the design. It’s got a very Switch Lite inspired style to it. Complete with left and right triggers and bumpers, and even the same kind of joysticks you’d find on a Switch. It also looks like it has bottom-firing speakers, as well as vents on the top and back for better airflow and cooling.
It is worth noting that Duolingo has not suffered a data breach; the data leak was a result of web scraping through public API abuse.
KEY FINDINGS
Extensive User Impact: The breach affects a substantial user base, with the personal data of over 2.6 million individuals exposed.
Comprehensive Data Set: The compromised information includes diverse details like usernames, full names, email addresses, countries, language course subscriptions, and account creation dates.
Vulnerable API Exploitation: The breach was executed through the exploitation of a public API, highlighting the potential risks posed by publicly accessible interfaces.
Data Misuse Concerns: The breadth of exposed data raises concerns about potential misuse, including identity theft, phishing, and cybercrime targeting affected users.
Heightened Privacy Risks: Users’ privacy is at stake due to the depth of sensitive data exposed, emphasizing the need for robust cybersecurity measures in safeguarding personal information.
A hacker has recently disclosed the personal information of approximately 2.6 million users of the popular language-learning platform, Duolingo. Contrary to a conventional data breach where hackers infiltrate an organization’s servers, this incident involved the exploitation of a public API.
The hacker, who also serves as a moderator on the Breach Forums, managed to scrape user data in January 2023, leading to the exposure of account-related details for a vast number of Duolingo users.
Duolingo, known for its accessible and engaging language courses, was caught off guard by the incident. The breach, while not originating from a direct assault on Duolingo’s servers or infrastructure, highlights the complex challenges organizations face in safeguarding user information in a hostile and uncertain environment created by threat actors.
Leaked Data
Hackread.com has examined and analyzed the exposed data, shedding light on its contents. The dataset encompasses the personal information of a staggering 2,658,787 users. This encompassing collection includes critical details such as:
Full names
Usernames
Email addresses
Countries of origin
The precise dates of account creation
The language courses to which users have subscribed
Notably, the gravity of the breach escalated when, prior to the public leak, another threat actor attempted to sell the same dataset for $1500. The revelation of the data on hacker forums and Telegram channels has only exacerbated concerns regarding user privacy and the potential misuse of exposed information.
Screenshot from the leaked Duolingo data (Image credit: Hackread.com)
Duolingo data leaked and sold on Breach Forums (Image credit: Hackread.com)
Duolingo, in response to the breach, is diligently investigating the situation and has intensified its efforts to secure user data. The incident has catalyzed discussions about the protection of user information in an era where APIs, often considered as open doors to data, require heightened vigilance.
In an environment where personal data is an invaluable currency, Duolingo data scraping stands as a testament to the ever-evolving methods of hackers and the pressing need for organizations to remain resilient against cyber threats.
As users await the outcome of Duolingo’s investigation, the incident underscores the collective responsibility to maintain digital security and protect user data from falling into the wrong hands.
