- tech360.tv
Dell Issues Warning of Data Breach Impacting 49 Million Customers
Dell warns customers of a data breach impacting approximately 49 million individuals. Stolen information includes names, physical addresses, and Dell hardware and order details. No financial or payment information, email addresses, or telephone numbers were compromised.
The company recently began sending out notifications to customers, informing them that a Dell portal containing customer information related to purchases had been breached.
In a data breach notification shared with BleepingComputer, Dell stated, "We are currently investigating an incident involving a Dell portal, which contains a database with limited types of customer information related to purchases from Dell. We believe there is not a significant risk to our customers given the type of information involved."
The following customer information was accessed by the threat actor during the breach: names, physical addresses, Dell hardware and order information (including service tag, item description, date of order, and related warranty information). However, Dell emphasises that no financial or payment information, email addresses, or telephone numbers were compromised.
Dell is actively working with law enforcement agencies and a third-party forensics firm to conduct a thorough investigation into the incident. When contacted by BleepingComputer for further details, Dell declined to disclose specific information, citing an ongoing investigation.
The breach came to light when a threat actor named Menelik attempted to sell a Dell database on the Breach Forums hacking forum on April 28th, as reported by Daily Dark Web. Menelik claimed to have stolen data from Dell, including information on 49 million customers and other systems purchased between 2017 and 2024. Although it has not been confirmed if this is the same data disclosed by Dell, the details align with the information provided in the data breach notification.
It is worth noting that the post on the Breach Forums has since been removed, suggesting that another threat actor may have acquired the database. While Dell maintains that the risk to customers is not significant, the stolen information could potentially be exploited in targeted attacks against Dell customers.
Although email addresses were not compromised, threat actors could still employ tactics such as physical mailings containing phishing links or media (such as DVDs or thumb drives) that install malware on recipients' devices. While this may seem unlikely, similar attacks have occurred in the past, such as tampered Ledger hardware wallets sent via physical mail or gifts containing USB drives that install malware.
As the stolen database is no longer available for sale, it is highly probable that a threat actor is attempting to monetise it through various types of attacks. Therefore, it is crucial for Dell customers to exercise caution when receiving emails or physical mailings claiming to be from Dell, especially if they request software installations, password changes, or any other potentially risky actions.
If you receive any suspicious emails or physical mailings, it is advisable to contact Dell directly to verify their legitimacy before taking any action.
Dell warns customers of a data breach impacting approximately 49 million individuals.
Stolen information includes names, physical addresses, and Dell hardware and order details.
No financial or payment information, email addresses, or telephone numbers were compromised.
Source: BLEEPING COMPUTER