Personal data of Kashmir University students hacked; check list

The University of Kashmir appears to have been the victim of a cyber attack. The personal details of over a million Kashmir University students have been spotted on the dark web.

According to AppleInsider, a hack of 5.4 million users is small compared to the 478 million T-Mobile customers affected in August 2021. It's even small compared to the 70 million AT&T users affected that same month.

As per the post, He has Student Info, Registration Number, Email, Password, Employees and more data. He shared a txt file named "dbs.txt" showing an index of the same. I am sharing the index through Pastebin.

However, according to to Restore Privacy, the hacked data now for sale stems from a vulnerability that was reported in January 2022.

The microblogging site acknowledged that this was a valid security issue and even paid the discoverer, "zhirinovskiy", a $5,040 reward.

"Exactly as HackerOne user zhirinovskiy described in the initial report from January, a threat actor is now selling the data allegedly acquired from this vulnerability," said Sven Taylor of Restore Privacy.

"The post is still live now with the Twitter database allegedly consisting of 5.4 million users up for sale."

Just spotted an alleged database of "University of Kashmir" being sold on a hacking forum. Threat actor goes by the name "ViktorLustig" selling the database of @KmrUniversity for $250.

He shared a Database index showing what he has.
(1/3) pic.twitter.com/me6AbpKlfA

— Abhishek Verma (@w3Abhishek) August 6, 2022

"The vendor is asking at least $30,000 for the database, which is now available due to 'Twitter incompetence,' according to the vendor."

The seller has posted about the data on the Breach Forums site. According to Restore Privacy, the forum owner has verified the authenticity of the leak.

A sample of the available data is included in the Breach Forums post. It appears to display publicly available Twitter profile information along with phone numbers and/or email addresses used to log in.

It doesn't seem to include passwords. While it does contain email addresses that could be used with Twitter's "forgot password" feature, a bad actor would have to have separate access to that email account's login password.

• India aiming to climate goals, As PM Modi’s commitment at COP26
• Atul Kulkarni’s old tweet “What makes you think I am a Hindu” is on trolls target
• Gurez valley: The hidden jewel of Kashmir
• How climate change is affecting birds?
• India bringing African cheetahs to Kuno Sanctuary in MP but Why?
• Namibia desperate to legalize Ivory trade, asked India to support in exchange of cheetahs

You can connect with Ground Report on Facebook, Twitter, Koo App, Instagram, and Whatsapp and Subscribe to our YouTube channel. For suggestions and writeups mail us at [email protected]