Cyber Incident Victim: Wappalyzer
Date:
Jan 2020
Location:
Netherlands
Summary
A cybersecurity breach occurred when an unauthorized party accessed an exposed database, leading to the theft of technographic data detailing website infrastructure components like server types and CMS platforms, alongside email addresses of approximately 16,000 customers who had requested dataset quotes and billing addresses of those who placed orders. The attacker attempted to monetize the stolen information by emailing affected users and offering the database for sale via Bitcoin, though the compromised data was characterized as outdated and non-sensitive, with no passwords or payment details involved. The organization advised vigilance against suspicious communications and emphasized that continuous dataset updates reduced the potential value of the exfiltrated information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early 2020, Wappalyzer experienced a security breach when an unauthorized individual accessed an exposed database on January 20. The intrusion remained undetected until April, when the hacker began directly contacting Wappalyzer's customers via email. These unsolicited messages claimed possession of the company's complete database and offered to sell the stolen information for $2,000 in Bitcoin, accompanied by screenshots verifying the compromised data. The attacker specifically targeted users whose contact details appeared in the database, leveraging the stolen information to solicit payments through cryptocurrency transactions. Wappalyzer confirmed the breach originated from an improperly secured legacy system that had been left accessible online, though the organization maintained that the incident's severity was limited due to the nature of the exposed records.
The compromised database primarily contained technographic details about websites, including server configurations, content management systems, and JavaScript libraries—information Wappalyzer routinely collects for its analytics services. However, the breach also exposed personally identifiable information belonging to approximately 16,000 customers who had requested dataset quotations, along with billing addresses from historical orders. No financial data or password credentials were accessed during the incident. Wappalyzer responded by advising affected users to treat solicitation emails as spam, emphasizing that the stolen records represented outdated snapshots due to continuous dataset updates. Company founder Elbert Alias publicly cautioned against engaging with the hacker's ransom demands, noting the diminishing utility of the aging data. The event underscored operational risks associated with maintaining exposed legacy infrastructure and demonstrated how attackers monetize even non-sensitive information through extortion tactics.