The threat actor behind the recent Dell data breach that exposed 49 million customer records claims they were able to access internal systems for weeks before being discovered.
The hacker, Menelik, was reported to be selling access to a database storing 49 million records related to systems purchased from Dell between 2017 and 2024.
Dell disclosed the breach on 9 May, notifying customers that their names, addresses, and Dell customer info were exposed, warning them to watch out for social engineering attacks impersonating the technology giant.
Menelik told TechCrunch they were able to gain access to the database by registering several accounts on a Dell portal as a partner that resells Dell products and services.
According to Menelik, the process of registering and being approved as a partner was relatively simple and did not require verification, with a potential hacker only needing to enter a set of company details and give a reason for wanting to become a partner, and Dell will approve you in under two days.
After Dell approved the new partner accounts, he then brute-forced customer service tags over the course of 3 weeks by spamming requests to a database storing sensitive information, all without Dell noticing.
“[I] sent more than 5,000 requests per minute to this page that contains sensitive information. Believe me or not, I kept doing this for nearly 3 weeks and Dell did not notice anything. Nearly 50 Million requests…After I thought I got enough data, I sent multiple emails to Dell and notified the vulnerability. It took them nearly a week to patch it all up,” Menelik told TechCrunch.
The cyber criminal added that he stopped scraping at some point and thus did not obtain the complete database with customer data, but was still able to demonstrate to the publication that the data was legitimate by cross-referencing the database with information of customers who received the breach notification from Dell – with their permission.
Dell maintains customers are not exposed to ‘significant risk’
Dell denied that they were unaware of the unauthorized access and claimed they were already investigating the incident when they received the emails from Menelik disclosing the vulnerability.
Dell argued the “limited types of information” accessed by the hacker will limit the potential for the stolen data to be used in a future attacks, as the data did not contain sensitive details like email addresses , phone numbers or financial data,
Dell gave the following comment to ITPro in response to the incident, insisting that customers were not exposed to ‘significant risk’.
“Dell Technologies has a cybersecurity program designed to limit risk to our environments, including those used by our customers and partners. Our program includes prompt assessment and response to identified threats and risks,” the firm said.
Why endpoint security needs to be part of a zero trust strategy
“We recently identified an incident involving a Dell portal with access to a database containing limited types of customer information including name, physical address, and certain Dell hardware and order information. It did not include financial or payment information, email address, telephone number or any highly sensitive customer data. Upon discovering this incident, we promptly implemented our incident response procedures, applied containment measures, began investigating, and notified law enforcement. “
“Our investigation is supported by external forensic specialists. We continue to monitor the situation and take steps to protect our customers’ information. Although we don’t believe there is significant risk to our customers given the type of information involved, we are taking proactive steps to notify them as appropriate.”
