Disney‘s internal Slack containing unreleased projects leaked – hackers

A hacktivist group claims to have stolen over one terabyte of data from Disney’s internal Slack channels, which were used by the mega conglomerates’ developers.

The attacker group, calling itself NullBulge, alleges that the stolen data includes information taken from 10,000 Slack channels, including all messages and files.

“1.1TiB of files and chat messages. Anything we could get our hands on, we downloaded and packaged up. Want to see what goes on behind the doors?” attackers said in an X post.

We have reached out to Disney for confirmation and comment and will update the article once the company replies.

According to the attackers’ post on a popular data leak forum, the stolen data includes unreleased projects, raw images and code, some login details, links to internal web pages, and other information.

Unconfirmed reports claim the leak includes information from Slack chats, which are full of employee files, various screenshots, images of pets, phone numbers, and other information that employees tend to share over Slack, the popular office messaging app.

The attackers’ blog post alleges that the heist was possible due to an insider collaborator. The cybercriminals claimed they weren’t able to get more data because “our inside man got cold feet and kicked us out!”

Internal chat leaks pose severe risks to exposed companies, as messages provide malicious actors with the means to compromise sensitive information, conduct unauthorized access, and potentially exploit confidential company resources.

While the leak is still unconfirmed, if the attackers’ claims were proven, the dataset could serve as a goldmine for cybercriminals. For example, ransomware gangs often target victims who have the biggest potential to allow for supply-chain attacks, and exposed company secrets could facilitate attackers penetrating deep inside the company.

In the past, attackers have taunted companies after breaching their internal Slack channels. The hackers of MGM and Caesars used the companies’ messaging platforms to monitor employee activity and gather additional information.

Last year, video game publisher Activision suffered a data breach, with threat actors accessing its corporate Slack environment and game release calendar.

In 2022, an attacker penetrated Uber’s cyber defenses and left a message on its Slack channels, supposedly in protest over the company’s driver remuneration policy.

Meanwhile, Nullbulge is a rather obscure group that claims to be “a hacktivist group protecting artists' rights and ensuring fair compensation for their work.” The group supposedly targeted AI users with malicious stable diffusion tools, uploaded to GitHub.

If confirmed, the Disney hack would be the second major data breach announced in a few days. AT&T, the American multinational telecommunication company, said its customer data was illegally downloaded from a third-party cloud platform, affecting nearly all customers.