A data leak that apparently put users’ assets in danger since June 2021 was secretly patched by cryptocurrency exchange Huobi.
Huobi Data Breach Fixed, but Contact Details of 4960 Users Already Leaked
According to white hat hacker and citizen journalist Aaron Phillips, the breach involved the disclosure of credentials giving write access to all of Huobi’s AWS S3 buckets, which the company utilizes for its cloud storage. Huobi’s domains, including huobi.com and hbfile.net, might have had their content altered by anyone with access to the credentials. User information and corporate papers were also susceptible to exposure, according to Phillips.
The Breach Could Have Led to the Biggest Crypto Theft in History
Phillips claimed that the breach’s severity was substantial and that it presented an opportunity for attackers to commit the biggest crypto heist in history. On June 20, according to Phillips, Huobi, which manages over $10 billion in monthly trading activity, erased the compromised account and secured its cloud storage. However, Phillips did not discover any proof that an attack was carried out using the breach.
Huobi Claims Data Breach Fixed
The incident this time involved the leakage of user contact information on a small scale (4,960 individuals). The type of information leaked does not involve sensitive information and does not affect user accounts and fund security. The incident occurred on June 22, 2021, due to improper operations by personnel related to the S3 bucket in the testing environment of the Huobi Japanese AWS site. The relevant user information was completely isolated on October 8, 2022.
Huobi
In the end, Huobi’s response to the breach fixed the problem and safeguarded its cloud storage. The white hat did not hear back from Huobi for several months, and the credentials were still available online even after he initially alerted Huobi to the problem in June 2022, according to Phillips.
Huobi Japanese site and Huobi Global site are completely different entities. After being discovered by a white hat team, the Huobi Security Team promptly took action on June 21, 2023, immediately closing the relevant file access permissions. The current issue has been fixed, and all related user information has been deleted. We appreciate the contributions made by the white hat team to Huobi’s security,
Huobi
1 Comment