Cyber Incident Victim: Whoosh
Date:
Nov 2022
Location:
Russia
Summary
Whoosh, a Russian scooter-sharing service, suffered a data breach where hackers stole and attempted to sell records of 7.2 million users, including email addresses, phone numbers, and first names. Partial payment card details for 1.9 million individuals and 3 million promotional codes enabling free rentals were also compromised. The company initially claimed to have thwarted the cyberattack but later acknowledged the leak while asserting that sensitive account access, transaction data, and full payment information remained secure. Law enforcement collaboration was initiated to prevent further dissemination of the stolen data. The threat actor offered the database for sale at $4,200 per buyer via a hacking forum and Telegram, linking the theft to a prior intrusion.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early November 2022, Russian scooter-sharing service Whoosh suffered a cyberattack that compromised customer data. The company initially claimed its IT experts successfully thwarted the attack in statements to Russian media shortly after the incident. However, on November 11, 2022, a threat actor listed a database containing 7.2 million Whoosh user records for sale on the 'Breached' hacking forum. The seller advertised the data as including email addresses, phone numbers, and first names of customers, along with partial payment card details for 1.9 million users and 3 million promotional codes enabling free scooter rentals. The attacker specified selling exclusively to five buyers at $4,200 each (.21490980 bitcoin) via SatoshiDisk, though no purchases had been recorded at the time of reporting. A separate Telegram sale post attributed the data theft to the November 2022 attack on Whoosh.
Whoosh confirmed the data breach on November 14, 2022, through a statement to RIA Novosti, acknowledging the leak while collaborating with law enforcement to prevent further dissemination. The company maintained that compromised information excluded sensitive account access credentials, transaction histories, travel patterns, and full payment card details, asserting its security protocols prevented third parties from obtaining complete banking data. The incident occurred amid heightened cybersecurity challenges in Russia, with Roskomnadzor documenting 40 confirmed corporate breaches between January-August 2022 and Group-IB reporting 140 Russian company database sales during summer 2022 alone, collectively exposing 304 million records. Whoosh's breach ranked among significant 2022 Russian data exposures alongside incidents like the Yandex Food leak, which triggered additional collateral data compromises.