Despite Paying Ransom ! Data Got Leaked

The famous subtitles website OpenSubtitles admitted that its undergone a threat attack and  had been hacked resulted in exposing the details of nearly seven million user accounts were leaked, even after paying a ransom.

According to OpenSubtitles’ administrator, the opensubtitles.org website was hacked during August 2021. The attacker had exploited a series of vulnerabilities to obtain user data and then asked for an undisclosed amount of bitcoin in exchange for not making the hack public and deleting the data.

The hacker was able to break the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data. Details with respect to user personal information are stolen.

While the ransom was allegedly paid, the data obtained as a result of the hack has recently surfaced online.The Have I Been Pwned breach notification service has identified more than 6.7 million user records, including username, email, IP address, country, and unsalted MD5 password hash.

OpenSubtitles users have been advised to change their password. The site claims to have implemented various security improvements on opensubtitles.org in response to the incident, and noted that its new site, opensubtitles.com, was built with better security from the start.

It’s often advised against paying a ransom to cybercriminals as it encourages them to continue their malicious activities, and there is no guarantee that the attacker will hold up their end of the bargain. The OpenSubtitles hack is a perfect example of this.