- October 27, 2020
- Posted by: administrator
- Category: Google, MicroSoft, Threat News
A massive data breach suffered by the Nitro PDF service impacts many well-known organizations, including Google, Apple, Microsoft, Chase, and Citibank.
Claimed to be used by over 10 thousand business customers and 1.8 million licensed users, Nitro is an application used to create, edit, and sign PDFs and digital documents.
As part of their service offering, Nitro offers a cloud service used by customers to share documents with coworkers or other organizations involved in the document creation process.
Nitro software suffers a data breach
On October 21st, Nitro Software issued an advisory to the Australia Stock Exchange, stating that they were affected by a “low impact security incident” but that no customer data was impacted.
It turns out that there may be more to the story than initially stated.
Cybersecurity intelligence firm Cyble has told BleepingComputer that a threat actor is selling the user and document databases, as well as 1TB of documents, that they claim to have stolen from Nitro Software’s cloud service.
This data is now being sold in a private auction with the starting price set at $80,000.
Cyble states that the ‘user_credential’ database table contains 70 million user records containing email addresses, full names, bcrypt hashed passwords, titles, company names, IP addresses, and other system-related data.
BleepingComputer was able to determine the stolen user database’s authenticity by confirming known email addresses of Nitro accounts that were present in the database.
The document database contains a file’s title, whether it was created, signed, what account owns the document, and whether it’s public.
According to Cyble, these databases contains a considerable amount of records related to well-known companies, as illustrated in the table below:
From the samples of the database shared with BleepingComputer, the document titles alone disclose a great deal of information about financial reports, M&A activities, NDAs, or product releases.
If the threat actors stole the documents as they claim, this could be one of the worst corporate data breaches we have seen in a while.
As Nitro is commonly used by businesses to sign sensitive financial, legal, and marketing documents digitally, it could allow for the leaking of information that would significantly impact a company’s business.
BleepingComputer has not been able to confirm if documents were stolen in this attack.
For those who are concerned that their Nitro account is part of this breach, Cyble has added the data to their AmIBreached.com service. Users can submit their email address and check if it was disclosed in the stolen database using this service.
BleepingComputer has contacted Nitro Software with questions regarding the breach but has not received a reply.
NOTE:: This article is copyright by bleepingcomputer.com and we are using it for educational or Information purpose only