Trello did not lead anything here.
A credential stuffing attack found 15M email addresses that attackers already knew had Trello accounts.
A credential stuffing attack found 15M email addresses that attackers already knew had Trello accounts.
Even in 2017 it seemed to me Atlassian only bought it so anyone else couldn't have it and they would like it to die in the future but for the time being they could use it as future customer acquisition entry for their main products ( Jira and Confluence )
Their disinterest in Trello in recent years might just be what has saved it for so long. Once their crack teams of product development people arrives it will be game-over.
> Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred
> enumerating a publicly accessible resource
> Trello advised that no unauthorised access had occurred
That sounds like a credential stuffing attack to me!
Most likely the attackers used the password reset form, and that Trello acknowledge the existence of emails. This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice.
Alternatively it's possible they used some sort of sharing functionality to try to share Trello content with other addresses, and again the availability of that for usage would be by-design.
> This used to be considered bad practice, but it's more nuanced than that, provides basically no useful information, and is now considered to be a relatively safe practice.
Against this:
> 15M email addresses
While you're saying that Trello leaked nothing, it strikes me as odd that an attacker could successfully interrogate a public resource enough times to confirm the existence of 15 million addresses without triggering some kinds of checks/balances to prevent such enumeration.
I understand this is meaningfully different than other kinds of leaks (i.e. an actual compromise), but it still indicates an issue on the Trello side.
I'd agree that 15 million requests should trigger something, but it depends on how long this happened over. Fundamentally, rate limiting access to a public resource is not a security mechanism against disclosure from that source, rate limiting is only a viable countermeasure against denial of service style attacks. So while there may be some improvements Trello could make here, I don't think they'd materially change this.
Which is surely far below the CTR one would expect for people actually using the share feature on Trello.