Whatever is on the web and work with the web can suffer data breaches. This time, it's Email.it that suffered a hack.
Email.it is a professional email services from Italy that utilizes the cloud.
With over half a million really active mailboxes, the email platform is designed to handle the needs of any kind of user, private and companies, large or small.
And here, it was first reported by ZDNet that the data of more than 600,000 of Email.it users are being sold on the dark web.
"Unfortunately, we must confirm that we have suffered a hacker attack," said the Italian email service provider.
The company realized about this hack, when hackers with the name of NN (No Name) Hacking Group, went to Twitter to share a link to a dark web website that sells the company's data. The hackers claimed that the hack took place in January 2018.
Citing from the website:
The hackers said that the databases contain information on users who signed up for a free Email.it email account.
On February 1, the hackers tried to extort Email.it for "a little bounty", but received no reply. The company declined to pay, and instead notified the Italian Postal Police (CNAIPIC).
Because the company didn't cooperate, the hackers are then selling the company's data for an asking price that varies between 0.5 and 3 Bitcoin ($3,500 and $22,000).
"We targeted and breached other providers of course. Email.it was the worst in terms of security so we have chosen to public that. Email.it refused to reply us also if we proposed to help them to fix the vulns after a 'bounty' payment," the hackers said.
The hackers claim that the databases contain plaintext passwords, plaintest SMS messages sent through Email.it's SMS-sending service, security questions users have created, email content, and email attachments for more than 600,000 users who signed up and used Email.it's service between 2007 to 2020.
Furthermore, the hackers also said they managed to exfiltrate the source code of all Email.it's web apps, including its administrator and user-facing applications.
Email.it did not deny any of the hackers' claims, but only clarified that the company had no financial information stored on the hacked server.
"The attack only concerned a server with administrative data (billing addresses and data for service communications)," Email.it said.
The company said that it patched the server and notified the authorities, including the country's local data privacy regulator. The company also said that its Business account users were not affected by this hack because their information was stored in a separate server.
What makes the situation worse is that, Email.it until this date has yet to disclose the data breach to its users, even if it was obliged by the European privacy legislation GDPR.
