In a blog post published on Friday, the hacking group NullBulge claimed to have leaked more than one terabyte of data belonging to The Walt Disney Company, including information from hundreds of Slack conversations.
Its proprietary Slack workplace collaboration system had private chats stolen.
Secret messages regarding Disney’s advertising efforts, the studio’s unique technology, and even interview transcripts for job openings were leaked by the breach.
The blog post by the hacking group revealed proprietary computer code and details about unreleased projects.
The stolen material dates back to at least 2019, and it includes discussions on managing Disney’s corporate website, software development, and job candidate ratings.
The NullBulge gang of hackers has stated that it is a hacktivist organization that is fighting for the rights of creative artists. They have chosen Disney and other businesses as targets in their protest of the abuse of its employees.
An online post from a NullBulge representative allegedly said that the company singled out Disney because of its use of AI.
According to cybersecurity experts, hackers have gained access to Slack accounts by using stolen or released API keys.
In the Disney breach, hackers obtained access to public chat groups, for instance. This happened because public Slack rooms are usually accessible using Slack API keys by default.
It is too soon to say for sure what caused such a massive breach, although others have speculated that typical suspects like social engineering, phishing, and weak passwords may not have penetrated all of the Slack channels.
This incident emphasizes the importance of enhancing the security of workplace communication platforms and implementing better monitoring and threat detection systems to avoid such widespread data breaches.
These systems use contextual analysis and content inspection, along with encryption and policy enforcement, to detect, track, and secure sensitive information.