Hacker Claims To Be Selling Credentials Of 20 Million OpenAI Accounts
Contents
It’s no surprise that hackers are always on the lookout for your precious data. Although big tech giants claim to have invested billions in their cybersecurity infrastructure, we often hear about data breaches. Last year, many big companies, including Google, confirmed data breach incidents. It seems the latest victim of hackers is OpenAI. A hacker is reportedly selling login credentials of 20 million OpenAI user accounts.
A hacker claimed to have access to the credentials of 20 million OpenAI accounts
Last week, folks over at Malwarebytes reported discovering a large dataset for sale on BreachForum, which is a cybercrime forum. A hacker who goes by the name “emirking” reportedly listed it, claiming that it has “20 million access codes to OpenAI accounts.”
While the report doesn’t exclusively mention the claims to be genuine, it outlines how the hacker may have gained access to such a large amount of data. A part of the report notes, “If the claim is true, emirking may have found a way to compromise the auth0.openai.com subdomain by exploiting a vulnerability or by obtaining administrator credentials.”
After the hacker’s claim of 20 million compromised accounts spread like wildfire, OpenAI was quick to investigate. Once the AI company concluded the investigation, it issued a statement that read, “We take these claims seriously. We have not seen any evidence that this is connected to a compromise of OpenAI systems to date.”
Findings by cybersecurity firm, KELA
While the uncertainty around the hacker’s claims of 20 million compromised OpenAI accounts loomed, a cybersecurity firm, KELA, analyzed the listed dataset. After analyzing the data, the cybersecurity firm noted that the hacker gained the credentials through infostealer malware.
KELA cross-referenced such credentials with its data lake of compromised accounts. That data lake reportedly contains a billion records gained using infostealer malware. In fact, all the credentials were related to those accounts. Therefore, KELA concluded that the data listed on BreachForum doesn’t indicate a breach of OpenAI’s system.
