Multiple organizations in Iran were breached by a mysterious hacker

Hudson Researchers reported that a mysterious hacker launched a series of attacks against industry-leading companies in Iran.

Hudson Researchers reported that on December 20th, a hacker using the moniker ‘irleaks’ announced the availability for sale of over 160,000,000 records allegedly stolen from 23 leading insurance companies in Iran.

The hacker claims that stolen data includes first name, last name, birth date, father’s name, phone number, mobile number, national code, company national code and more. The hacker also shared a sample of the data, which it available for a total price of $60,000.

Hudson Rock analyzed the sample data and confirmed that it appeared to be genuine. It is still unclear how the hackers targeted so many insurance companies at the same time.

On December 30, irleaks also claimed to have hacked SnappFood, the Iranian largest delivery platform, and stolen 3 Terabytes.

According to the announcement, Irleak is offering:

• 20,000,000 users data (emails, passwords, phone numbers)
• 51,000,000 user addresses
• 600,000 credit cards data
• 180,000,000 device related information

“It is worth noting that although the origin of the breach is unknown, Hudson Rock researchers identified a recently compromised employee of SnappFood who had their computer infected with a StealC infostealer.” reported Hudson Rock. “The infection of this employee’s computer resulted in many sensitive credentials of the organization being accessible to some hackers and may have been used as an initial attack vector against the company.”

The researchers believe the attacks can be the result of a coordinated operation conducted by a nation-state actor.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iran)