The perpetrators of this week's data breach of Landmark Group's loyalty programme Shukran may have gained only basic user information, but that could be enough to commit more damaging fraudulent activity.
On Wednesday, the Dubai-based conglomerate said it was investigating a cyber incident involving “unauthorised access” to Shukran, involving customer names, contact details and dates of birth. Shukran's initial assessment on its website remained unchanged on Saturday.
Analysts caution that this type of data could be used to create convincing impersonation scams, phishing messages and other forms of social engineering in which a victim is coerced to reveal sensitive information.
“The key concern is that a data breach does not need to involve financial information to create opportunities for financial fraud,” Mohamed Emam, a security researcher at Singapore-based cybersecurity firm Group-IB, told The National.
“Even when financial information is not compromised, exposed customer names and phone numbers can still be valuable to cybercriminals.”
How fast can stolen data be shared?
After information has been extracted from a compromised system, it has the potential to travel very quickly through the dark web – in mere minutes with some reports even claiming instantly – including in cybercrime forums, illicit marketplaces and private messaging channels.
“Stolen information can circulate rapidly within cybercriminal communities. Depending on the nature of the breach and the attacker's intentions, compromised data may be offered for sale or shared on underground forums within hours of being obtained,” Mr Emam said.
“However, not every breach results in immediate publication or sale. In some cases, attackers may retain the information for their own operations or distribute it privately.”
Stolen data “can also be combined with information obtained from previous breaches to build more detailed profiles of individuals”, Maher Yamout, a lead security researcher at Kaspersky, told The National.
That point is related to what US data privacy firm Cloaked calls the archive and enrichment phase, which typically happens two years after the data was stolen. It is a part of a broader journey for stolen data, according to the New York-based company.
The first three phases are the triage window, the first 24 to 72 hours in which data is sorted and tested before hitting a marketplace; the general sale from weeks two through eight, where data is made available for bulk buys; and commodity pricing from the third to the 12th month, where a collection of data pulled from multiple breaches is sold at lower rates.
A domino effect is also on the table, because threat actors can weaponise the stolen data on a broader scale, particularly involving the other accounts of victims. An example is a scammer calling and coercing you to reset your bank app password.
“In the Shukran incident … [the stolen data] may not sound as serious as passwords or payment card details, but this information is typically sold to other criminal organisations on the dark web for use in future attacks on consumers,” Danny Jenkins, chief executive and co-founder of US cybersecurity company ThreatLocker, told The National.
“Containing a breach is essential, but it does not mean the risk to affected customers has gone away. Even if the most sensitive data has been protected, any personal identifiable information can be of value to criminals.”
Worst-case scenario
That's part of more severe outcomes. Mr Yamout said the worst-case scenario is that seemingly basic personal information becomes the starting point for targeted attacks, with names, phone numbers and dates of birth giving criminals the tools to establish credibility and tailor their approach to individual victims.
“This could lead to phishing attacks, identity fraud, account takeover attempts or financial scams if the method of the attack is convincing enough to trick victims into disclosing additional information or security credentials,” he said.
If scammers successfully obtain login credentials, verification codes or other authentication information, the consequences could extend to account takeover, unauthorised transactions or identity-related fraud, Mr Emam cautioned.
“The severity of the risk depends on what information was actually exposed and whether attackers can combine it with data obtained from other sources,” he said.
“The immediate concern is not necessarily what criminals can do with a phone number alone, but what they may convince someone to reveal by using that information to gain their trust.”
