© 2023 CyberNews - Latest tech news,
product reviews, and analyses.

If you purchase via links on our site, we may receive affiliate commissions.

Hackers claim to have breached TikTok

BlueHornet hacker collective said it had hacked TikTok, providing samples of the exfiltrated data as proof.

"Who would have thought that @TikTok would decide to store all their internal backend source code on one Alibaba Cloud instance using a trashy password?" BlueHornet tweeted on September 3.

The threat group, also known as AgainstTheWest, said it had already pulled out over 790GB of data. In total, the threat actor has already extracted over 2 billion records.

"Considering the entries are from all over the world, it is unlikely we will sell or release this. Lastly, this data contains a lot of underaged people. Releasing such information, along with the data that is being stored without user's knowledge, is so dire that we think it could spark something dangerous," AgainstTheWest said on Breach Forums.

I've reached out to TikTok for the official statement but received no immediate response. In response to Bloomberg, TikTok's spokesperson neither confirmed nor denied the breach, saying that big tech companies are under rigorous scrutiny, and the data advertised could be simply scraped from the site.

BlueHornet (Against The West) has shared screenshots and data samples to support its claims. However, at this point, we can't be sure whether these claims are valid. The threat actor also claimed to have internal WeChat data.

In a statement to Bleeping Computer, TikTok later said this data couldn’t have been scraped from the website, and the group’s statements are false. Meanwhile, security researcher Bob Diachenko said the breach is real.

In April, cybersecurity company Cyberint published a blog post, calling BlueHornet one of the more interesting advanced persistent threat (APT) groups currently in play. BlueHornet has been observed targeting major organizations and other APT groups from Russia, China, Iran, and North Korea.

After the Russian invasion of Ukraine, the group went public on Twitter and hit waves with several campaigns against threat groups supporting Russia. It found a handful of potential targets when about 30 groups sided with Russia at the beginning of the war.

More from Cybernews:

Malicious hackers steal $375k from a popular NFT platform

Hacktivists turn Belarusian president’s passport into NFT

Crypto fraud on the rise as consumers fall for fake celebrity endorsements

North Korean hackers use fake Coinbase job ads to lure crypto buffs

A HackerOne employee submitted stolen vulnerability reports

Subscribe to our newsletter

Leave a Reply

Your email address will not be published. Required fields are marked