Hacker News Reader

Comment by grtuhxdxb | Hacker News Reader

Bad title. Attackers queried Trello with email addresses and got back names, usernames and if the addresses were valid. You can use a lot of services to do that, but usually they cost money.

> > Trello In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum. Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred

View on HN

How can they confirm that the email addresses were all from previous breach corpuses without buying said corpuses? Attackers could have been probing for first name + last name combinations to confirm business email addresses, for instance. Just because the parameter was "email address" doesn't mean that those email addresses weren't automatically generated.

You misunderstand, I have a very unique French email address and I got the email. There is no way they enumerated my email address, there is no way they matched 15M randomly generated first.last@gmail.com emails: mine wasn't even that.

For info, that same email address has been receiving many many haveibeenpwned warnings, it's everywhere and I consider it basically completely public lol.

Than be bold and post it here! /s

No doubt they used breach corpuses, but the question is how Trello knows that that was all that the attackers submitted to the endpoint.

That’s still leaking.

You are both correct. The title is bad since it says "Trello leaked 15M email addresses" but the email addresses were already leaked and were used to look up the additional details. It is still leaking (names and usernames), but Trello didn't leak 15m email addresses.

I bet they did it via the "share" button. Put in an email and Trello returns a name and username. Would be pretty trivial to have a bot slowly enter emails over time.

Reply on news.ycombinator.com