Vevo, the multinational video service, has been successfully hacked and had a very large data leak through a weakness in the Vevo security servers.
Vevo, the joint venture between Universal Music Group, Sony Music Entertainment, Abu Dhabi Media, Warner Music Group, and Alphabet Inc, has had 3.12TB worth of internal files stolen and posted online.
The leaked files contained a large vault of information; from office documents, pre-planned social media content, and weekly music charts, which all seem pretty mild, to the much more sensitive data, like the exact details of how to set/unset the security alarm to the Vevo UK office.
The hacker group who are claiming to be responsible for this, OurMine, are a group of white hat hackers, who are fairly well known for targeted attacks. Their alleged hacks include: HBO’s Twitter account, Mark Zuckerberg’s Twitter and Pinterest accounts, BuzzFeed and TechCrunch, and they also hijacked WikiLeaks’ DNS.
OurMine use their hacking skills to demonstrate to companies that they have weak cyber security systems, and then try to sell their security products to these companies in order to secure their servers.
However, the group claim to have tried to warn Vevo of the breach privately before being ‘rudely’ shut down by an employee. OurMine responded with going public with the data breach, and all the files.
Vevo have confirmed the data breach, which was as a result of phishing scam via Linkedin. They are addressing the issue and investigating further.
Mark James, ESET IT Security Specialist, discusses phishing scams and how to efficiently protect yourself, and your workplace, from data breaches like this.
“We often have a clear divide between internal and external dangers thus protecting as required, but when someone from the outside compromises an account that has a good level of access on the internal network then all could be laid bare.
“Once in and unnoticed they can pretty much do as they please, to access information or attempt to get it out for offsite storage.
“It’s usually a slow safe approach so as not to alert the tech teams if bandwidth suddenly and consistently is being used at high rates, but once it’s offsite then it’s just time and effort to search the booty and see what spoils they have.
“A lot of it will be useless, but there is always something somewhere that is stored in the wrong place or not locked down sufficiently.
“A security practice that has not been followed, or even the case of someone creating and storing a document without thinking to themselves, what would happen if this whole document appeared online TODAY?
“We have to assume that we are a target.
“Companies need to review their security practices often, ensure systems are up-to-date, patched and running the latest versions of their operating systems.
“All staff should be aware of current threat attacks doing the rounds and the dangers they can bring.”
What do you think of a hacker group targeting a company to sell them their solutions? Let us know on Twitter @ESETUK.
Join the ESET UK LinkedIn Group and stay up to date with the blog. If you are interested in seeing where ESET has been featured in the news then check out our ‘In the news’ section.