Catalin Cimpanu reports:
The Australian Computer Emergency Response Team (AusCERT) denied claims today that hackers had breached the Department of Education, Skills, and Employment (DoE), and downloaded the personal details of more than one million students, teachers, and staff.
Rumors of a supposed hack first surfaced yesterday after a hacker shared an archive file on a hacker forum, which they initially advertised as data obtained from the Australian DoE.
According to a screenshot of a now-deleted forum post, the hacker claimed the data contained more than one million records for Australian students, teachers, and DoE staff, that they obtained back in 2019.
Read more on ZDNet. As you will read, that claim was false. AusCERT working with Troy Hunt and Cosive identified the data set as a re-dump of a data leak earlier this year by K7Maths.
As a secondary issue, there are increasing criticisms of social media accounts who just repeat unverified claims by threat actors — such as those who repeated the forum listing’s claim that the data set on was from the Australian “Department of Education” (an agency that apparently doesn’t even exist?).
After the listing appeared, at least one Twitter account just repeated the claims. Justin Hendry of iTnews took @UndertheBreach to task for that. That account later posted an update correcting the source, but more entities are pointing out the potential harm done when social media accounts just repeat unverified claims. Incorrect claims can do unfair reputation harm to entities, while even correct repetition of claims about ransomware attacks allegedly help criminals increase pressure on victims to pay. DataBreaches.net has yet to see any actual confirmation of that possibility, however reasonable it sounds.