The FBI is warning that hackers are acquiring personal consumer data — together with emails and telephone numbers — from U.S.-based tech firms by compromising authorities and police electronic mail addresses to submit “emergency” knowledge requests.
The FBI’s public notice filed this week is a uncommon admission from the federal authorities concerning the risk from fraudulent emergency knowledge requests, a authorized course of designed to assist police and federal authorities acquire data from firms to reply to speedy threats affecting somebody’s life or property. The abuse of emergency knowledge requests just isn’t new, and has been widely reported in recent years. Now, the FBI warns that it noticed an “uptick” round August in prison posts internet advertising entry to or conducting fraudulent emergency knowledge requests, and that it was going public for consciousness.
“Cyber-criminals are possible having access to compromised US and international authorities electronic mail addresses and utilizing them to conduct fraudulent emergency knowledge requests to US primarily based firms, exposing the non-public data of shoppers to additional use for prison functions,” reads the FBI’s advisory.
Police and legislation enforcement within the U.S. typically want some kind of legal justification to hunt and acquire entry to non-public knowledge that firms retailer on their servers. Usually for an individual’s personal content material, like their information, emails, or messages, police want to supply sufficient proof of a potential crime earlier than a U.S. courtroom will subject a search warrant permitting the police to request that data from a personal firm. Police can subject subpoenas — which don’t require going to a courtroom — requesting firms to entry restricted quantities of details about a consumer, corresponding to their fundamental account data, like their username, account logins, electronic mail addresses, and telephone numbers, and typically their approximate location.
There are additionally emergency requests, a process by which legislation enforcement can urgently search an individual’s data from an organization within the occasion of a direct threat, the place there is no such thing as a time to hunt a courtroom order.
It’s these emergency requests that federal authorities say some cybercriminals are abusing.
The FBI stated in its advisory that it had seen a number of public posts made by identified cybercriminals over 2023 and 2024, claiming entry to electronic mail addresses utilized by U.S. legislation enforcement and a few international governments. The FBI says this entry was in the end used to ship fraudulent subpoenas and different authorized calls for to U.S. firms searching for personal consumer knowledge saved on their programs.
The advisory stated that the cybercriminals have been profitable in masquerading as legislation enforcement through the use of compromised police accounts to ship emails to firms requesting consumer knowledge. In some circumstances, the requests cited false threats, like claims of human trafficking and, in a single case, that a person would “undergo drastically or die” until the corporate in query returns the requested data.
The FBI stated the compromised entry to legislation enforcement accounts allowed the hackers to generate legitimate-looking subpoenas that resulted in firms turning over usernames, emails, telephone numbers, and different personal details about their customers. However not all fraudulent makes an attempt to file emergency knowledge requests have been profitable, the FBI stated.
Cybercriminals typically use the requested knowledge for harassment, doxing, and focusing on people with monetary fraud schemes, according to a Bloomberg report from 2022, which discovered on the time that hackers had obtained consumer data from clients of Apple, and Fb and Instagram-owner Meta, by submitting fraudulent emergency knowledge requests. Snap, the maker of Snapchat, and Discord have been additionally reportedly focused.
Apple, Google, Meta, and Snap, which retailer large quantities of shoppers’ private and personal knowledge, collectively obtain tens of 1000’s of emergency knowledge requests yearly.
Bloomberg reported in 2022 that a few of the fraudulent emergency knowledge requests date as far again as early 2021, and have been carried out by groups of mostly teenagers and young adults, corresponding to Recursion Crew, and later, Lapsus$, which went on to hack into some of the world’s largest companies, together with Uber.
The FBI stated in its advisory that legislation enforcement organizations ought to take steps to enhance their cybersecurity posture to forestall intrusions, together with stronger passwords and multi-factor authentication. The FBI stated that non-public firms “ought to apply vital pondering to any emergency knowledge requests obtained,” provided that cybercriminals “perceive the necessity for exigency.”
