D-Link rubbishes hacker's claims, says data breach impacted decade-old data records

Taiwanese multinational networking equipment manufacturer D-Link said it suffered a significant data breach that compromised legacy data associated with its users.

Last week, a threat actor listed D-Link as a victim on their dark web leak site and claimed responsibility for infiltrating the company’s network and stealing the sensitive personal data of its customers and employees. The threat actor also shared samples of the stolen data that dated back to 2012.

“I have breached the internal network of D-Link in Taiwan, I have 3 million lines of customer information, as well as source code to D-View extracted from system. This does include the information of MANY government officials in Taiwan, as well as the CEOs and employees of the company,” the threat actor said.

They claimed to be in possession of sensitive personal data including names, email addresses, physical addresses, company names, phone numbers, registration dates and last sign in details. The threat actor is willing to sell the stolen database of 1.2GB for $500.

Acknowledging the claims of a data breach, D-Link said in a notice on its website that immediately after learning about the security incident, it launched an investigation to understand the authenticity of the claims.

“Through internal and external investigations by experts from Trend Micro, the company identified numerous inaccuracies and exaggerations in the claim that were intentionally misleading and did not align with facts,” D-Link said.

“The data was confirmed not from the cloud but likely originated from an old D-View 6 system, which reached its end of life as early as 2015. The data was used for registration purposes back then.

“So far, no evidence suggests the archaic data contained any user IDs or financial information. However, some low-sensitivity and semi-public information, such as contact names or office email addresses, were indicated,” the company added.

According to D-Link,the cyber security incident resulted from “an employee unintentionally falling victim to a phishing attack, resulting in unauthorised access to long-unused and outdated data.”

While the company is still in the process of investigating the cyber attack, it added that “approximately 700 outdated and fragmented records that had been inactive for at least seven years” have been accessed by the threat actor and not “millions of user data”.

D-Link believes that its current customers haven’t been impacted by the incident, however, it has asked all its employees and customers to remain vigilant for any kind of cybercrimes.