Push Admin

Data of 3.3 million Cashalo users allegedly sold on the dark web

Article (news)

ABS-CBN News

MANILA - Sensitive data of 3.3 million Cashalo users have allegedly been sold on the dark web, the country&#x27;s privacy body said Tuesday.The National Privacy Commission (NPC) said the published details include usernames, passwords, e-mail addresses, phone numbers, and device identifications of users of the cash-loaning app.<blockquote class="twitter-tweet">Sensitive data of 3.3 million Cashalo users have been sold on the dark web, accdg to <a href="https://twitter.com/PrivacyPH?ref_src=twsrc%5Etfw">@PrivacyPH</a> The details published include usernames, passwords, e-mail addresses, phone numbers, and device identifications.— Jacque Manabat (@jacquemanabat) <a href="https://twitter.com/jacquemanabat/status/1364120792267558912?ref_src=twsrc%5Etfw">February 23, 2021</a></blockquote><div><script async="" src="https://platform.twitter.com/widgets.js" charSet="utf-8" type="text/javascript"></script></div>NPC&#x27;s initial probe showed that a user under the name &quot;creepxploit&quot; sold data of Cashalo users on the dark web, as shared in a post on http://cybleinc.com and RaidForums. The post provided sample data for potential buyers.In a statement, the NPC said these data were dumped into different cyber forums since Feb. 14.User &quot;creepxploit&quot; may have successfully downloaded the files from the application&#x27;s database, which is still up for selling, said the NPC.Cashalo said their cybersecurity team discovered a potential data security incident on Feb. 18, involving a Cashalo-only database archive.It said an individual claimed to be in possession of a Cashalo customer database taken from a non-production system used by the company. This resulted in unauthorized access to a database archive of Cashalo customers.Cashalo said its encryption implementation ensured that no customer accounts or passwords were compromised.The company said it has since taken the system offline, activated investigations, and conducted impact assessments. It is also currently working closely with the NPC.The NPC received Cashalo&#x27;s report evening of Feb. 19.Cashalo said they are notifying affected users about the potential data breach.Roren Marie Chin, Chief of the Public Information and Assistance Divison of the NPC, said subscribers may wait for a notification from the Cashalo if they are included in the list of the affected accounts.She advised Cashalo users to be vigilant with their accounts, change passwords, and implement other security measures.<div>report from Jacque Manabat, ABS-CBN News</div><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/news/06/18/20/pup-investigating-reports-of-compromised-student-portal">PUP, FEU student portals hacked</a></li>	<li><a href="https://news.abs-cbn.com/business/04/24/20/google-shows-web-users-how-to-fight-scammers-using-covid-19">Google shows web users how to fight scammers using COVID-19</a></li></ul>

Sensitive data of 3.3 million Cashalo users have been sold on the dark web, the country's privacy body said Tuesday.

Sensitive data of 3.3 million Cashalo users have been sold on the dark web, the country's privacy body said Tuesday.