Major Data Breach in Brazil: 248,725 Users Exposed in CIEE One Hack

TL;DR

Cybercriminals recently targeted Brazil’s CIEE One platform, leading to a significant data breach that exposed the personal information of 248,725 users. The compromised data, including ID records and medical reports, was later sold on the dark web by a data broker known as “888.” The breach highlights the vulnerabilities in cloud storage configurations and the need for robust cybersecurity measures.

Introduction

In a recent cybersecurity incident, Brazil’s CIEE One platform, which connects businesses with trainees, suffered a data breach exposing the personal information of 248,725 users. The compromised data included sensitive details such as ID records, contact information, medical reports, and scanned documents. This breach underscores the growing threat of cybercrime and the importance of securing cloud storage solutions.

Details of the Breach

Resecurity identified the data breach on the CIEE One platform, a major service in Brazil that facilitates recruitment and selection for internships and apprenticeships. The platform is widely used by top financial institutions and various other sectors, including energy, telecommunications, and technology providers. The breach was attributed to an exposed Google Cloud Storage bucket, which allowed unauthorized access to sensitive data.

Impact and Motivation

Cybercriminals targeted CIEE One due to the large amount of sensitive personal information (PII) it aggregates for recruitment processes. The stolen data was later sold on the dark web by an underground data broker known as “888.” This broker has a history of targeting corporations and is known for selling acquired databases exclusively, maintaining a reputation within the underground community.

Role of “888”

The profile of “888” has been active since at least 2024, with successful attacks on major corporations such as Microsoft and BMW (Hong Kong). This actor is financially motivated and targets public-facing services and applications. The activities of “888” overlap with those of other notable actors like IntelBroker, who was indicted by the FBI for monetizing stolen data on the dark web.

Cloud Storage Vulnerabilities

The breach highlights the widespread issue of misconfigured cloud storage buckets, which are often exploited by threat actors. According to expert statistics, 41% of cloud breaches are caused by misconfigurations, making them a leading contributor to data theft. The lack of adequate protection and configuration hardening for cloud services exacerbates this problem.

Response and Mitigation

Resecurity’s HUNTER team alerted the affected parties and shared intelligence with Computer Emergency Response Team Brazil (CERT.br). However, the exposed cloud buckets remain widely exploitable, emphasizing the need for stronger security measures in cloud configurations.

Conclusion

The CIEE One data breach serves as a stark reminder of the importance of robust cybersecurity practices, particularly in securing cloud storage solutions. As cybercriminals continue to exploit vulnerabilities for financial gain, organizations must prioritize data protection to safeguard sensitive information and maintain public trust.

Additional Resources

For further insights, check:

• Resecurity Blog
• Dark Web Cybercrime
• Security Affairs

References