Shell’s customer data claimed to be leaked
Private data allegedly belonging to around 80,000 of Shell’s customers has been found on a hacker forum. Shell claims the company is not the owner of the data.
Image from Shutterstock
Private data allegedly belonging to around 80,000 of Shell’s customers has been found on a hacker forum. Shell claims the company is not the owner of the data.
A threat actor has listed a dataset for sale that allegedly belongs to the British multinational oil and gas company Shell. The dataset contains sensitive information, such as first names, last names, email addresses, phone numbers, and home addresses.
The cybercriminal behind the dataset listing claims that the data is from clients across the UK, Australia, France, India, Singapore, Philipines, Netherlands, Malaysia, and Canada.
While the leaked data seems legit, Cybernews could not independently verify the claims. Cybernews has reached out to the company for comment.
A Shell spokesperson told Cybernews that an investigation of the potential security incident showed that the data in question did not come from the Shell system.
“Shell is not the owner nor controller of the acquired data, and so we are not able to comment further on this incident. We take cybersecurity very seriously, and we will continue to monitor our IT systems and maintain our security posture,” said the company in a written statement.
According to the company, a vendor who provides Shell globally with anonymous mystery shopping services, had a cybersecurity incident. The vendor used a third-party platform to store data related to its contractors, the ‘mystery shoppers’, and this data was exposed through this third-party platform.
“The vendor has confirmed they have begun the process of notifying impacted individuals and regulatory bodies,” stated the spokesperson.
In 2023, oil and gas giant became the victim of a ransomware attack on a MOVEit file transfer platform that affected thousands of companies worldwide.
The Russian-linked ransomware group Cl0p claimed to have posted stolen data on its dark net site. At the time, Shell’s spokesperson told Cybernews that the impact of the Moveit breach was minimal.
Updated on June 7th with the Shell's statement.