Gov.UK Database Leak 2024

Organization: Gov.UK
Industry: Government
Service: Official government services and information for the United Kingdom

Date of Incident: May 6, 2024
Threat Actor: User "USDoD" on a dark web forum
Method of Breach: Exploitation of a misconfigured Content Delivery Network (CDN) system
Data Compromised: Usernames and passwords of over 1 million users; approximately 80,000 records released in the initial leak
Leak Description: The attacker claimed to have extracted data from the Gov.UK system due to a misconfiguration, providing a partial CSV database download link with 80,000 user records.
Data Exfiltration: The attacker made it clear they have more data and are monitoring global reactions before releasing the full database.

Alias: USDoD
Forum Activity: The attacker was active on a well-known dark web forum and has since self-banned their account after posting the breach.
Motivation: Unclear, but the threat actor warned that they are monitoring global activities, hinting at possible future releases or extortion.

Potential Risks:
- User Credential Exposure: The leaked usernames and passwords could lead to account takeovers, particularly if users reuse passwords across different services.
- Phishing & Fraud: Attackers may use the compromised data for phishing attacks, potentially leading to identity theft or financial fraud.
- Government Services Disruption: The breach could undermine trust in UK government services, leading to a significant public relations issue and a need for increased security measures.
Scale of Impact: The leak affects over 1 million users, with 80,000 records already exposed. This could escalate if the full database is released.