3 ms·

Bad title. Attackers queried Trello with email addresses and got back names, usernames and if the addresses were valid. You can use a lot of services to do that

Bad title. Attackers queried Trello with email addresses and got back names, usernames and if the addresses were valid. You can use a lot of services to do that, but usually they cost money. > > Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred

jbverschoor 3y ago
That’s still leaking.
- amanzi 3y ago
  You are both correct. The title is bad since it says "Trello leaked 15M email addresses" but the email addresses were already leaked and were used to look up the additional details. It is still leaking (names and usernames), but Trello didn't leak 15m email addresses.
btown 3y ago
How can they confirm that the email addresses were all from previous breach corpuses without buying said corpuses? Attackers could have been probing for first name + last name combinations to confirm business email addresses, for instance. Just because the parameter was "email address" doesn't mean that those email addresses weren't automatically generated.
- xwolfi 3y ago
  You misunderstand, I have a very unique French email address and I got the email. There is no way they enumerated my email address, there is no way they matched 15M randomly generated first.last@gmail.com emails: mine wasn't even that. For info, that same email address has been receiving many many haveibeenpwned warnings, it's everywhere and I consider it basically completely public lol.
  - Ringz 3y ago
    Than be bold and post it here! /s
  - btown 3y ago
    No doubt they used breach corpuses, but the question is how Trello knows that that was all that the attackers submitted to the endpoint.
MattGaiser 3y ago
I bet they did it via the "share" button. Put in an email and Trello returns a name and username. Would be pretty trivial to have a bot slowly enter emails over time.

jbverschoor 3y ago

That’s still leaking.

amanzi 3y ago
You are both correct. The title is bad since it says "Trello leaked 15M email addresses" but the email addresses were already leaked and were used to look up the additional details. It is still leaking (names and usernames), but Trello didn't leak 15m email addresses.

btown 3y ago

How can they confirm that the email addresses were all from previous breach corpuses without buying said corpuses? Attackers could have been probing for first name + last name combinations to confirm business email addresses, for instance. Just because the parameter was "email address" doesn't mean that those email addresses weren't automatically generated.

xwolfi 3y ago
You misunderstand, I have a very unique French email address and I got the email. There is no way they enumerated my email address, there is no way they matched 15M randomly generated first.last@gmail.com emails: mine wasn't even that. For info, that same email address has been receiving many many haveibeenpwned warnings, it's everywhere and I consider it basically completely public lol.
- Ringz 3y ago
  Than be bold and post it here! /s
- btown 3y ago
  No doubt they used breach corpuses, but the question is how Trello knows that that was all that the attackers submitted to the endpoint.

MattGaiser 3y ago

I bet they did it via the "share" button. Put in an email and Trello returns a name and username. Would be pretty trivial to have a bot slowly enter emails over time.