Over 200,000 OpenAI credentials were found by security researchers for sale on the dark web as stolen logs. Buyers may access chats containing private information including trade secrets, source code, and business plans, as well as use ChatGPT’s premium services for free, through the compromised credentials.
400,000 business credentials from various online accounts, including Google Cloud Platform, AWS, Salesforce, QuickBooks, and Hubspot, were found, according to a closed study by Flare that studied 19.6 million leaked logs.
The business also found 205,447 compromised OpenAI account credentials that were stolen via commodity malware log harvesting. It is still not apparent whether Flare’s discovery corresponds to Group IB’s.
Read More: OpenAI’s Sam Altman Launches Cryptocurrency Project Worldcoin
The finding comes after the threat intelligence team of cybersecurity company Group-IB reported that over 100,000 ChatGPT account credentials were sold on dark web markets between June 2022 and May 2023. The malware variants Raccoon Infostealer (78,348), Vidar (12,984), and RedLine (6,773) were used to steal the OpenAI credentials.
The Middle East and Africa (24.6%), Asia-Pacific (40.5%), and Europe (16.8%) were the regions where the most OpenAI credentials were offered for sale on dark web marketplaces. With 12,632 OpenAI credentials revealed on the dark web, India took the top spot, followed by Pakistan (9,217), Brazil (6,531), Vietnam (4,771), and Egypt (4,588), with the United States coming in sixth with 2,995 compromised accounts.
However, OpenAI later clarified that the compromised login credentials were not the result of any OpenAI data breach. Instead, they were the by-product of commodity malware-based log harvesting.
