OptimEyes AI, which offers Zero Trust Risk Management solutions to companies, was mocked by an individual under the alias “maia arson crimew” for an alleged data breach.
In a detailed blog post, the individual used unconfirmed leads of on OptimEyes AI data breach to troll the cybersecurity firm for being a victim of a cyber attack, before proceeding to explain the alleged data breach.
The post was likely made by a dealer or a hacker who came across the data dump. They claimed that the data was leaked the previous day by an anonymous 4chan user.
Alon Gal, Co-Founder & CTO at the cybercrime intelligence company Hudson Rock, posted screenshots of the dark web post along with a link to the blog.
Cybersecurity risk assessment company ‘OptimEyes’ allegedly hacked by a hacker who dumped their files on 4chan. They also pretty much humiliated them tbh,” he wrote.
OptimEyes AI data breach
(Photo: Alon Gal LinkedIn)
OptimEyes AI Data Breach: How was the data leaked?
Unlike other data breach posts cybercriminals and sellers make on the dark web, the one about the OptimEyes AI data breach ranted about the amount of data stolen by the hackers.
OptimEyes AI is a company that is focused specifically on “cyber risks”, and bolster their ability in visualizing and helping prevent IP theft, which makes it all so much more ironic how completely they have been hacked,” read the blog.
“As someone who loves a good bit of trolling against the infosec community, I obviously had to download the leak and take a look myself. It turns out it contains not only all the source code for the OptimEyes AI platform, but also tons of customer data, the fully trained ML models OptimEyes AI is built on and tons of hardcoded credentials for their infrastructure,” the blog stated.
The blog post further goes on into technical details, explaining how the OptimEyes AI data breach occurred.
(Photo: Alon Gal LinkedIn)
Mentioning the security gaps in the cybersecurity company’s infrastructure, the blog read wrote, “The build information for each past build contains a link to the git repository, including the bitbucket credentials in the URL. genius.”
Information dumped from the OptimEyes data breach
The leaked customer data from the alleged OptimEyes AI data breach included server inventories and vulnerability scans from their customer network. The customer data also had data from Hitachi Energy.
The entire AWS infrastructure of OptimEyes was said to be vulnerable due to the OptimEyes AI data breach.
The original hackers likely used the GitHub configuration of the repositories in the database for the credentials leaked on Jenkins, the poster inferred.
It looks like the hackers negotiated with the target for ransom. However, after failed attempts, they released the data online.
The website of OptimEyes AI was accessible at the time of writing.
The Cyber Express reached out to the cybersecurity company based in Encinitas, California for comment. However, we did not receive a reply.
Cybersecurity company compromised?
Speaking with The Cyber Express about targeting a cybersecurity company and the impending results, Alon said, “It is disheartening to see a company specializing in intellectual property theft prevention failing to secure their own systems adequately. This incident is a stark reminder that even companies focused on cybersecurity can fall victim to hacking.”
4chan is a popular and anonymous forum that had been in the news for hosting controversial content including explicit celebrity images.
The blog post concluded with a text that read, “This very much seems like a leak that was done for the lulz more than anything else, and it’s always fun to see more of that again.”