Condé Nast gets hacked, and DataBreaches gets “played” — Christmas lump of coal edition

Condé Nast became the target in a post describing a data leak on a few forums involving data from WIRED and Condé Nast, with DataBreaches stating that Lovely claimed to have downloaded more than 33 million accounts. According to DataBreaches[.]Net, Lovely said the vulnerabilities could allow an attacker to view account information and change any account’s email address and password, and they provided a list of JSON files showing the number of user accounts for each publication.

The author notes that Condé Nast lacks a security.txt file to explain how to report vulnerabilities, and that WIRED was contacted during the process without a reply from Condé Nast. After weeks of failed outreach, Lovely allegedly claimed to have remediated some vulnerabilities and then asserted that they had leaked data from WIRED on two forums, with DataBreaches concluding that Lovely had been dishonest and had “played” them. The piece ends with the assertion that Condé Nast should not pay them, and that the threat actor’s word could not be trusted.