Drivesure, a service provider for car dealerships, was the victim of a data breach virtual collaboration software in December that led to 26GB of private data being downloaded and distributed on forums for hackers. The data breached included names, addresses, and phone numbers of 3.2 millions buyers and sellers, as well as messages sent via email and text messages between the clients of traders, vehicle VINs, and service records. Also, more than 000 hashed passwords for bcrypt were released. While bcrypt hashes can be considered superior to older methods like SHA1 or MD5 however, they are still able to be used for brute force after downloading, reports Risk Based Security.

Hacker «pompompurin» described the leaked user data and files in a lengthy post on Raidforums. This is atypical, since hackers typically only share valuable parts or trimmed-down versions the databases they’ve discovered.

According to CISO Magazine, the database was exposed due to a misconfiguration in an AWS bucket that was utilized by the company. The AWS bucket was left unprotected for several months and allowed anyone to access the database and its contents, including more than a million unique email addresses as well as passwords stored in plaintext, and encrypted with bcrypt.

Drivesure users should be worried about the breach, since they could be victims of fraud or identity theft if their data is stolen. Those who use the site must change their passwords as soon as possible. Additionally, they should consider changing their login information on other sites where they use the same credentials.