As Disney garnered over 10 million subscribers for its online streaming service Disney+ on its first day of operation, reports have surfaced on Monday that hackers have already hijacked thousands of accounts and put them up for sale on the Dark Web.
ZDNet discovered several listings for Disney+ accounts on different underground hacking forums, selling for somewhere between $3 and $5.
The Disney+ launch was marred by technical issues and users reported being unable to stream their favourite movies and shows.
Several users reported losing access to their accounts.
“Many users reported that hackers were accessing their accounts, logging them out of all devices, and then changing the account’s email and password, effectively taking over the account and locking the previous owner out,” said the report on.
Disney was yet to comment.
In some cases, hackers gained access to accounts by using email and password combos leaked at other sites, while in other cases “the Disney+ credentials might have been obtained from users infected with keylogging or info-stealing malware”.
Researchers asked Disney+ to help users by rolling out support for multi-factor authentication and prevent more attacks.
On the very first day of release on November 12, Disney+ users collectively spent 1.3 million hours streaming and watching the content available to them on the platform for the first day of release.
As per reports, analysts projected that Disney+ would have anywhere between 10-18 million subscribers in its first year. Disney has signed up more than half of those projected numbers in 24 hours.
The service was launched in the US for $6.99 per month or $69 per year.
The new breed of hackers is flexing their muscles and now, cybersecurity firms which aim to safeguard your data are being hit right in their backyard — signaling a worrisome trend for enterprises and governments as encryption is proving to be fundamentally flawed.
In a bizarre incident late last month, global cybersecurity firm Palo Alto Networks “admitted” that the personal details of its seven current and former employees had been “inadvertently” published online by a “third-party vendor”.
The personal details of some past and present employees — their names, dates of birth and social security numbers — were exposed online.
Palo Alto Networks, however, did not divulge further details on who the third party vendor was and how the personal details of the employees were leaked.
San Francisco-based HackerOne which itself is a vulnerability coordination and bug bounty platform and boasts of clients like Starbucks, Instagram, Goldman Sachs, Twitter and Zomato, last week paid $20,000 to a community user who exposed a vulnerability in its own bug bounty platform.
The vulnerability was exposed by a user with the handle called “haxta4ok00”.
“I can read all reports @security and more programmes,” posted the hacker on the community page.
“I did it to show the impact. I didn’t mean any harm by it. I reported it to you at once. I was not sure that after the token substitution I would own all the rights. I apologise if I did anything wrong. But it was just a white hack”.
The big question arises: How safe is our data with the cyber security enterprises that have mushroomed in the recent past.
In a statement shared with IANS, HackerOne said it believes in transparency and the vital role it plays in building trust.
“This was a vulnerability reported through HackerOne’s own bug bounty programme by an active HackerOne hacker community member and was safely resolved. The team followed standard protocol to conduct a comprehensive investigation of the issue and implement immediate and long-term fixes. All customers impacted were notified the same day,” HackerOne noted.
“It may seem counterintuitive to publish when things go wrong, but many companies face similar security challenges, and the value of public disclosure for the public and our community far outweighs the risk,” the company added.
Palo Alto Networks said they took immediate action to remove the data from public access and terminate the vendor relationship.
“We also promptly reported the incident to the appropriate authorities and to the impacted individuals. We take the protection of our employees’ information very seriously and have taken steps to prevent similar incidents from occurring in the future,” the company said in a statement.
The big question arises: If cybersecurity firms are unable to thwart hacking on their platforms, where would an individual or a firm in India go to secure data?
“Both these incidents show that deliberate actions or even mistakes by companies can cripple huge security systems,” Virag Gupta, a lawyer who is arguing the case in Supreme Court for data localisation in India, told IANS.
The Data Protection Bill, which has been cleared by the Cabinet, envisages “sensitive” personal data to be stored in India, but it can be processed outside the country with the explicit consent of the individual concerned.
“Critical” personal data, which is another classified data, can only be stored and processed in India and will not leave the country. What constitutes “critical’ data” will be defined by the government at the time of framing regulations.