Cyber Threat Actor: DFrank

Prison Break, also known as DFrank, is a threat actor whose known activity is limited to a single reported incident in Brazil. The actor used the alias DFrank when leaking personal data from the e‑commerce platform Netshoes on December 5 2017. The leak consisted of four Pastebin posts containing information for 17 908 Netshoes customers. According to the actor’s own statement to TecMundo, the data were obtained by exploiting vulnerabilities in the company’s systems through a fuzzing technique that allowed access to the source code. The disclosed data did not include banking details, credit‑card numbers or account passwords, although the company warned that the exposed personal information could be used for social‑engineering attacks.

The actor’s self‑described objective was to force companies to stop claiming that consumer data are secure and to stop misleading people into believing their personal information is safe. This objective was expressed directly in the actor’s comment to TecMundo. The reported targeting appears focused on the Brazilian e‑commerce sector, as the only verified victim is Netshoes, a major online retailer operating in Brazil. The described initial access vector relies on fuzzing, a technique that feeds malformed or unexpected inputs to an application to uncover coding flaws that can be leveraged for entry. No specific malware families, exploit kits or tooling beyond the use of Pastebin for data publication were referenced in the source material.

Public attribution does not link Prison Break/DFrank to any state‑sponsored group, criminal consortium or larger hacking collective. The Netshoes leak remains the sole publicly documented operation associated with this actor, and no follow‑up campaigns or additional victims have been reported in the available sources. Consequently, the threat actor’s current activity level, capabilities and affiliations remain unknown beyond the details of this single incident.