Rankiteo Logo
Rankiteo
Leader in Cyber Underwriting
Loading...
NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop
WindowsmacOSLinux
Download
Analyze » The Hacker News » THE1841518112625

Incident Score: Analysis & Impact (THE1841518112625)

The details regarding individual company incidents & reports gives you full view from every side.

Rankiteo Score Impact Analysis

Rankiteo Incident Impact-64
Company Score Before Incident586 / 1000
Company Score After Incident522 / 1000
Company LinkView The Hacker News Profile
INCIDENT NUMBERTHE1841518112625
Type of Cyber IncidentBreach
ATTACK VECTORUnprotected Public Feature, Predictable URL Structure, Lack of Access Controls
DATA EXPOSEDActive Directory credentials, Database and...
INCIDENT DATE25/11/2025
STATUSDisclosed by WatchTowr; no official resolution or patch confirmed

Key Highlights From The Incident Analysis

  • Timeline of The Hacker News's Breach and lateral movement inside company's environment.
  • Overview of affected data sets, including SSNs and PHI, and why they materially increase incident severity.
  • How Rankiteo’s incident engine converts technical details into a normalized incident score.
  • How this cyber incident impacts The Hacker News Rankiteo cyber scoring and cyber rating.
  • Rankiteo’s MITRE ATT&CK correlation analysis for this incident, with associated confidence level.

Full Incident Analysis Transcript

In this Rankiteo incident briefing, we review the The Hacker News breach identified under incident ID THE1841518112625.

The analysis begins with a detailed overview of The Hacker News's information like the linkedin page: https://www.linkedin.com/company/thehackernews, the number of followers: 716230, the industry type: Computer and Network Security and the number of employees: 85 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 586 and after the incident was 522 with a difference of -64 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on The Hacker News and their customers.

JSONFormatter recently reported "JSONFormatter and CodeBeautify Exposing Sensitive Data via Unprotected 'Recent Links' Features", a noteworthy cybersecurity incident.

Researchers from WatchTowr discovered that JSONFormatter and CodeBeautify, popular code formatting sites, were exposing sensitive data through unprotected 'Recent Links' features.

The disruption is felt across the environment, and exposing Active Directory credentials, Database and cloud credentials and Private keys.

In response, and began remediation that includes Public Warning by WatchTowr and Advisory for Users to Avoid Uploading Sensitive Data, and stakeholders are being briefed through Public Disclosure via TechRadar and Researcher Advisory.

The case underscores how Disclosed by WatchTowr; no official resolution or patch confirmed, teams are taking away lessons such as Public-facing tools with 'Recent Links' or similar features must implement access controls and authentication, Sensitive data should never be uploaded to public code formatting or validation tools, even temporarily and Predictable URL structures in public services can be exploited for mass data harvesting, and recommending next steps like Disable or secure 'Recent Links' features with authentication and rate-limiting, Implement short-lived, randomized URLs for shared content to prevent scraping and Educate developers and employees on the risks of uploading sensitive data to public tools, with advisories going out to stakeholders covering WatchTowr public warning and TechRadar article.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.

MITRE ATT&CK® Correlation Analysis

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing: Spearphishing Link (T1566.002) with moderate to high confidence (70%), supported by evidence indicating criminals were already observed actively probing the flaw, attempting to use expired fake AWS keys uploaded as bait and Valid Accounts: Cloud Accounts (T1078.004) with high confidence (95%), supported by evidence indicating cloud/database credentials, API tokens, and payment gateway keys exposed via unprotected Recent Links feature. Under the Credential Access tactic, the analysis identified Unsecured Credentials: Credentials In Files (T1552.001) with high confidence (100%), supported by evidence indicating active Directory credentials, cloud/database credentials, private keys, API tokens, SSH session recordings exposed in raw data and Unsecured Credentials: Private Keys (T1552.004) with high confidence (100%), supported by evidence indicating private keys and SSH session recordings included in exposed data. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (95%), supported by evidence indicating five years of raw data scraped from Recent Links feature, including PII, KYC data, internal endpoints, IIS configurations and Data from Information Repositories: Code Repositories (T1213.002) with high confidence (90%), supported by evidence indicating code repository tokens, CI/CD secrets, and configuration files exposed via the platform. Under the Exfiltration tactic, the analysis identified Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (T1048.003) with high confidence (90%), supported by evidence indicating data exfiltration such as Yes (via automated scraping of Recent Links feature) with no encryption mentioned and Automated Exfiltration: Traversal (T1020.001) with high confidence (95%), supported by evidence indicating predictable URL structure enabling automated scraping and five years of raw data extracted. Under the Reconnaissance tactic, the analysis identified Gather Victim Host Information: Network Sniffing (T1592.004) with moderate to high confidence (85%), supported by evidence indicating internal endpoint details, IIS configurations, and system hardening settings exposed, enabling targeted intrusions and Gather Victim Network Information: Scan Databases (T1590.005) with moderate to high confidence (80%), supported by evidence indicating database credentials and payment gateway keys exposed, useful for mapping victim environments. Under the Defense Evasion tactic, the analysis identified Indicator Removal: File Deletion (T1070.004) with moderate to high confidence (70%), supported by evidence indicating criminals were already observed actively probing the flaw (suggests attempts to cover tracks post-exfiltration) and Impair Defenses: Disable or Modify Tools (T1562.001) with moderate to high confidence (75%), supported by evidence indicating exposure of system hardening settings could enable attackers to bypass security controls. Under the Impact tactic, the analysis identified Data Destruction (T1485) with moderate confidence (60%), supported by evidence indicating potential for large-scale breaches, identity theft, financial fraud, or supply-chain attacks (implied misuse of exposed keys/credentials) and Malicious Cyber Activity Against Critical Infrastructure (T1659) with moderate to high confidence (85%), supported by evidence indicating affected entities include government, aerospace, healthcare, energy, finance (high-value targets for disruptive attacks). These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.

Sources & References