DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

Some City University of New York data found on dark web market

Posted on June 9, 2021 by Dissent

One of the newer leak markets is Marketo. Marketo claims, “We put up for sale network accesses and passwords of networks of companies that do not contact us.”  They also maintain a Telegram channel where they elaborate on their service:

We are an independent marketplace for free placement and sale of data stolen by hackers. We are not affiliated with popular ransom groups today and condemn their work as it can harm people in the process of blocking networks and PCs. We are only concerned with information, and if it is of value, as Nathan Rothschild told us, then it can be sold and that is our business model. You can take a look around our site and contact us. Select the item you are interested in.

Listing on Marketo. Image: DataBreaches.net

In mid-May, when DataBreaches.net first became aware of the Marketo site, it contained a statement about entities that were then currently under attack, and a brag that their success rate was better than 85%. One of the sites allegedly then under attack was cuny.edu, the City University of New York. DataBreaches.net reached out to CUNY to ask them if they were aware of the claimed ongoing attack and to give them a heads up if they hadn’t been. The email was sent to security@.  They did not respond at all.

On May 31, Marketo listed CUNY.edu as completed, claiming that they had exfiltrated 11 GB of data. Their proof of claim package consisted of relatively innocuous files.

DataBreaches.net reached out to CUNY again to ask what it had done after this site had tried to alert them to a problem, and to ask what data the threat actors had acquired. Again, there was no response.

So DataBreaches.net asked Marketo what they could or would tell me about that incident, including when the attack began and when it was completed. I also asked whether personal nformation of students had been acquired. A Marketo spokesperson replied:

So, first, I can’t tell you about the date of the attack. Second, we don’t have the students data, so I’ll guess this won’t be much of an interest for you, but what we do have is contact payments, budget reports, projects, contracts and etc.

Marketo promised to provide additional details in a few days, but from the sound of things, this breach likely does not involve a lot of personally identifiable information — or even any. But what did CUNY do when this site attempted to warn them that they were supposedly under attack? How did they follow up, or didn’t they?

Today, DataBreaches.net sent a press inquiry to CUNY, asking what CUNY had done in response to the May 16th alert and to the attack itself.

So far, there has been no response.

This post will be updated if a response s received.

Category: Breach Incidents

Post navigation

← CA: Victor Valley Union High School District
Middletown Man Sentenced To Six Months of Home Confinement For Damaging Former Employer’s Computer Network →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • Nova Scotia Power hit by cyberattack, critical infrastructure targeted, no outages reported
  • Georgia hospital defeats data-tracking lawsuit
  • 60K BTC Wallets Tied to LockBit Ransomware Gang Leaked
  • UK: Legal Aid Agency hit by cyber security incident
  • Public notice for individuals affected by an information security breach in the Social Services, Health Care and Rescue Services Division of Helsinki
  • PowerSchool paid a hacker’s extortion demand, but now school district clients are being extorted anyway (3)
  • Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines
  • Call for Public Input: Essential Cybersecurity Protections for K-12 Schools (2025-26 SY)
  • Cyberattack puts healthcare on hold for hundreds in St. Louis metro
  • Europol: DDoS-for-hire empire brought down: Poland arrests 4 administrators, US seizes 9 domains

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Apple Siri Eavesdropping Payout Deadline Confirmed—How To Make A Claim
  • Privacy matters to Canadians – Privacy Commissioner of Canada marks Privacy Awareness Week with release of latest survey results
  • Missouri Clinic Must Give State AG Minor Trans Care Information
  • Georgia hospital defeats data-tracking lawsuit
  • No Postal Service Data Sharing to Deport Immigrants
  • DOGE aims to pool federal data, putting personal information at risk
  • Privacy concerns swirl around HHS plan to build Medicare, Medicaid database on autism

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.