Data leak exposes data of registered VirusTotal customers

[Gandalf_The_Grey]

Content source

https://borncity.com/win/2023/07/17/data-leak-exposes-data-of-registered-virustotal-customers/

The web service virustotal.com (founded by the Spanish company Hispasec Sistemas, taken over by Google), which has been operated by Google since 2012, is popular among security researchers and companies for checking suspicious files for malware.
However, there are warnings about how critical automated documents uploaded to Virustotal are with regard to data protection and data leaks, because the data can be viewed by third parties.
And even registering with virustotal.com is not a good idea, as a data leak shows.
The Austrian media STANDARD has received a list of registered customers of virustotal.com, which disclose names of employees including e-mail addresses. Some of those affected, from secret services or companies, would rather not see their data in public.

The Austrian STANDARD has received a file of only 313 kilobytes that would have been better never to become public. At the end of July 2023, this file probably reached the Internet via a data leak. The file is explosive: It contains a list of 5,600 names of customers of the virustotal.com platform who were registered there. This includes employees of the US intelligence agency NSA and German intelligence agencies.

How the file exactly became public (e.g. as an upload to Virustotal) is not revealed. However, based on the characteristics of the data, the file must have originated from the inner environment of virustotal.com.

The STANDARD, which has the file with the list, writes that in each case it contains the name of the organization and the e-mail address of the employees who registered the account on virustotal.com.

According to the STANDARD, it has checked the data together with German news magazine Der Spiegel, and the data is probably genuine. The incident shows how critical online activities are when data gets into the hands of unauthorized third parties via a leak. In the above case, there is a risk that the captured data will be misused for cyber attacks by means of social engineering.

Data leak exposes data of registered Virustotal customers

[German]The web service virustotal.com (founded by the Spanish company Hispasec Sistemas, taken over by Google), which has been operated by Google since 2012, is popular among security researchers and companies for checking suspicious files for malware. However, there are warnings about how...

borncity.com

 

[[correlate]]

VirusTotal: Datenleck offenbart Kunden der Google-Sicherheitsplattform

Auf VirusTotal überprüfen Unternehmen, Behörden und Sicherheitsexperten verdächtige Dateien und Webseiten. Nun zeigt ein Datenleak, wer den Google-Dienst nutzt – darunter sind auch deutsche Nachrichtendienste.

www.spiegel.de

 

[Gandalf_The_Grey]

VirusTotal: Datenleck offenbart Kunden der Google-Sicherheitsplattform

Auf VirusTotal überprüfen Unternehmen, Behörden und Sicherheitsexperten verdächtige Dateien und Webseiten. Nun zeigt ein Datenleak, wer den Google-Dienst nutzt – darunter sind auch deutsche Nachrichtendienste.

www.spiegel.de

I think this is the English translation of that German article:

VirusTotal: Data leak reveals customers of Google's security platform

On VirusTotal, businesses, government agencies, and security professionals scan suspicious files and websites. Now a data leak shows who uses the Google service – including German news services. Leaked list of VirusTotal customers includes the name of the organization and the e-mail address of...

www.tellerreport.com

 

[Gandalf_The_Grey]

Apology and Update on Recent Accidental Data Exposure

We are writing to share information about the recent customer data exposure incident on VirusTotal. We apologize for any concern or confusion this may have caused.

On June 29, an employee accidentally uploaded a CSV file to the VirusTotal platform. This CSV file contained limited information of our Premium account customers, specifically the names of companies, the associated VirusTotal group names, and the email addresses of group administrators. We removed the file, which was only accessible to partners and corporate clients, from our platform within one hour of its posting.

First and foremost, we want to clarify unequivocally: This was not the result of a cyber-attack or a vulnerability with VirusTotal. This was a human error, and there were no bad actors involved.

Apology and Update on Recent Accidental Data Exposure

We are writing to share information about the recent customer data exposure incident on VirusTotal. We apologize for any concern or confusio...

blog.virustotal.com