Threat actor scraped Dell support tickets, including customer phone numbers

The person who claimed to have stolen the physical addresses of 49 million Dell customers appears to have taken more data from a different Dell portal, TechCrunch has learned.

The newly compromised data includes names, phone numbers and email addresses of Dell customers. This personal data is contained in customer “service reports,” which also include information on replacement hardware and parts, comments from on-site engineers, dispatch numbers and, in some cases, diagnostic logs uploaded from the customer’s computer. 

Several reports seen by TechCrunch contain pictures apparently taken by customers and uploaded to Dell seeking technical support. Some of these pictures contain metadata revealing the precise GPS coordinates of the location where the customer took the photos, according to a sample of the scraped data obtained by TechCrunch. 

TechCrunch has confirmed that the customers’ personal information appears genuine.  

This is the second disclosure of exposed Dell customer data in as many weeks. Last week, Dell notified customers that it had experienced a data breach, saying in an email that the technology giant was investigating “an incident involving a Dell portal, which contains a database with limited types of customer information related to purchases from Dell.” 

The stolen data included customer names and physical addresses, as well as less sensitive data, such as “Dell hardware and order information, including service tag, item description, date of order and related warranty information.” 

Dell downplayed the breach at the time, saying that the spill of customer addresses did not pose “a significant risk to our customers,” and that the stolen information did not include “any highly sensitive customer information,” such as email addresses and phone numbers.

A person who goes by the online handle Menelik claimed responsibility for both data breaches. In an interview with TechCrunch, Menelik provided a sample of the data he stole, which allowed TechCrunch to verify that the data was legitimate. Menelik also provided copies of emails he sent to Dell, and the company confirmed to TechCrunch that it received an email about the data breach from Menelik.

Now, it appears Menelik found another flaw in another Dell portal, which allowed him to scrape more customer data.

“I did find something for email and phone number data,” Menelik told TechCrunch. “But I am not going to do anything with it yet. I want to see how Dell responds to current topic. [sic]”

Dell did not respond to TechCrunch’s request for comment. 

Menelik said that he had scraped the data of around 30,000 U.S. customers, and said that the flaws he is exploiting are similar to the bugs that allowed him to obtain the first round of 49 million customer records. But this second vulnerability prevents him from collecting the data as quickly as during the first breach.  

As TechCrunch first reported, in the first breach Menelik said he was able to scrape Dell customers’ data from a portal where he registered several accounts as a “partner,” meaning he pretended to run companies that resells Dell products or services. Once Dell approved his requests, Menelik said he was able to brute-force customer service tags, which are made of seven digits of only numbers and consonants. 

Menelik posted an advertisement on a well-known hacking forum attempting to sell the data. As of the writing of this article, the listing has been deleted, and Menelik said it’s because he sold the data, although he declined to say for how much. 

Asked what he plans to do with the new data, Menelik said that he hasn’t decided yet. 

Given that some of the scraped data contains personal information on customers in the European Union, TechCrunch reached out to Ireland’s national data protection authority, which did not immediately respond to a request for comment.

Contact Us

Do you know more about this Dell hack? Or similar data breaches? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.