In what is becoming a rather common trend, a threat actor is claiming to sell 487 million WhatsApp users’ mobile phone numbers on a popular hacking community forum which surfaced as an alternative to popular and now-seized Raidforums.
The 2022 database is said to contain WhatsApp user data from 84 countries with Egypt having the largest chunk of stolen phone numbers (45 million), Italy with 35 million, and the US with 32 million.
The complete list of countries is included in the original report by Cybernews which also contains the exact amount of numbers up for sale. According to the threat actor, they are willing to sell the US dataset for $7000, the UK one for $2500, and the German one for $2000.
Upon being requested, the threat actor also shared a sample of data with researchers who then confirmed that the numbers included in the sample were in fact WhatsApp users. The exact sample contained 1097 UK and 817 US mobile numbers.
The seller did not reveal their process for obtaining the database and simply said they “used their strategy” to collect the data. Whatever the method used, the damage that can be caused by this leakage should not be taken lightly.
Such data is readily bought by attackers to use for smishing and vishing attacks. It is advised that you cautiously interact with unknown calls, unsolicited calls, and messages. Impersonation and fraud are also common worries associated with mobile number leakage.
Meta has refused to comment on this for now, while in their report, Cybernews speculates that this information could have been obtained by harvesting information at scale, also known as scraping, which violates WhatsApp’s Terms of Service.
However, Hackread.com can confirm that, at the time of writing, the listing was deleted from the hacker forum. Another listing was published in which another threat actor is claiming to sell details of WhatsApp users.
It is worth noting that in January 2021, Facebook also sued a Portuguese company for developing malicious Chrome extensions allowing data scraping. In October 2021, Meta also sued a Ukrainian man for scraping and selling 178 million users of the social network and selling the data on hacker forums.
This news comes a year after massive Facebook data leak made the headlines in which data of 500 million users from 106 countries was scraped and leaked online. In April 2021, a threat actor was selling two scraped LinkedIn databases containing 500 million and 827 million account details.
In June 2021, in another web scraping related incident, a threat actor was selling 700 million LinkedIn users accounts.
RELATED NEWS
- Hackers leak scraped data of 87,000 GETTR users
- Scraped data of 1.3 million Clubhouse users published online
- Database of 176 million Pakistani mobile phone users sold online
- Leaky Server Exposing Scraped Data of 150,000 Mastodon Users
- Twitter Confirms Data Breach as 5.4M Accounts Sold on Hacker Forum
