Dell warns of user data breach — 49 million customers affected in security incident, here's what we know

News
By
published

The data was most likely already bought by a malicious actor

Data Breach
Image Credit: Shutterstock (Image credit: Shutterstock)

Dell has begun sending breach notification emails to some 49 million people whose data was apparently stolen in a recent cyberattack.

The type of information involved includes people’s names, postal addresses, and Dell hardware and order information, such as service tags, item description, order dates, and different warranty information.

"We are currently investigating an incident involving a Dell portal, which contains a database with limited types of customer information related to purchases from Dell," the company said in the notification letter. "We believe there is not a significant risk to our customers given the type of information involved."

Tangible risk

Dell has notified relevant authorities and brought in third-party cybersecurity experts to assess the damage. So far we don’t know if this was a simple data smash-and-grab, or a ransomware attempt.

The company believes the risk to its customers is not significant since financial and payment information, email addresses, and phone numbers were not stolen in this attack. 

However, the risk of phishing or even major malware and ransomware attacks still exists, since threat actors can send out personalized letters with removable drives and deploy malicious code that way. It has happened in the past.

At the same time, there is always a risk someone most likely already bought the database on the dark web. 

A cybercriminal with the alias Menelik posted a new thread on a dark web forum, advertising a Dell database fitting the company’s description: "49 million customer and other information systems purchased from Dell between 2017-2024." The thread was quickly deleted, which usually happens if someone buys the database.

Since the information was most likely already acquired, if you are a Dell customer who purchased hardware between 2017 and 2024, it would be wise to be extra wary of any communication claiming to be from the company, especially if you get it in the mailbox.

Via BleepingComputer

More from TechRadar Pro

TOPICS
Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.