Hacker group Distributed Denial of Secrets (DDoSecrets) released a treasure trove of data from 200 police departments across the United States, said Forbes. The leak aptly called the BlueLeaks, disclosed info from the police, as well as the Federal Bureau of Investigation (FBI).
DDoSecrets leaked 269 worth of police data with some dealing with the current pandemic and the Black Lives Matter protests after the killing of George Floyd. The data was published on June 19, also known as Juneteenth, to commemorate the abolition of slavery in the US.
The information covered by the leak includes data spanning 24 years. It includes officer’s badge numbers, FBI and police reports monitoring the protests, identifiable information of people in the protests and internal memos, said Business Insider.
Notably, the leaked info shows a report from the FBI sent to a police department detailing the tweets from an “identified twitter account.” Supposedly, this document was intended to protect “law enforcement supporters’ safety.”
The Business Insider article, however, noted that the leaks do not provide reports of police misconduct. Krebs on Security also remarked that it is unlikely to shed light on such matters.
The legitimacy of the Leak
Some parties were adamant about the legitimacy of BlueLeaks. However, Krebs on Security was able to confirm that the data is legitimate. According to the report, Krebs on Security was able to obtain an internal analysis by the National Fusion Center Association (NFCA) confirming its validity.
Further discussing the data dump, the NFCA analysis also revealed that it discloses names, email addresses, phone numbers images, videos, and PDF documents from the police. It also contains emails, texts, CSV, and ZIP files.
It covers highly sensitive information such as routing numbers, international bank account numbers (IBANs), financial data, personally identifiable information, and images related to suspects classified under Requests for Information (RFIs).
Regarding the source of the leaks, Krebs of Security cited the NFCA analysis saying that it stemmed from a security breach at Netsential, a web services company. Netsential caters to various fusion centers, as well as law enforcement and government agencies in the US.
The NFCA explained, “Netsential confirmed that this compromise was likely the result of a threat actor who leveraged a compromised Netsential customer user account and the web platform’s upload feature to introduce malicious content.”
When asked for comments, Netsential director Stephen Gartrell refused to make a statement.
