close
close
hsuses

Dell’s “security incident” could affect millions of people

Theo

Dell Technologies informed customers this week that a portal with access to a database containing customer information was involved in a security incident.

The hardware and software provider notified potentially affected customers via email, stating that the database contained names, physical addresses, Dell hardware and ordering information, service tags, order dates and related product information.

“Given the nature of the information involved, we believe there is no significant risk to our customers,” the letter said. It also recommended that customers only contact Dell if they notice suspicious activity in their accounts.

Dell is also working with an outside forensics firm on the investigation and has contacted law enforcement.

According to Mike Matchett, founder and analyst of Small World Big Data, the exposed information may not have an immediate impact on customers, but it represents a significant security vulnerability at one of the technology industry’s largest vendors.

It’s extremely poor doorstep security from a provider who should know better.

Mike MatchettFounder and Analyst of Small World Big Data

“It is extremely poor security on the doorstep from a provider who should know better,” he said. “I would question why they even have vulnerable portals with such large customer databases.”

Dark web offers

Daily Dark Web first reported a possible security breach on April 29th.

The website reported that individuals on the dark web attempted to sell data from 49 million Dell customer accounts. The data included information on systems purchased between 2017 and 2024 for a range of customers, including individuals, businesses and schools. Dell has not confirmed how many customers were notified of the breach.

In a statement to TechTarget Editorial, Dell said the company “discovered an incident involving a Dell portal with access to a database that contained limited types of customer information, including names, physical addresses, and certain Dell hardware and ordering information.”

According to Dell, customers’ financial and payment information, email addresses and phone numbers were not accessed.

Customers in online discussion groups said they received the letter on Thursday, but Dell did not specify in the letter when the incident occurred nor did it share that information with TechTarget Editorial.

Digital fallout

Dell is certainly not the only enterprise tech giant to have suffered a recent security incident, said Krista Macomber, an analyst at Futurum Group. Microsoft announced in January that there had been a data breach by Russian state-affiliated hackers.

An attack on these tech giants could result in more money being paid out to ransomware or hacking groups, with the potential to snoop on customer data for further attacks, according to Macomber.

“What we see is that attackers have an incentive to attack a larger vendor or security provider because they can access a web of customer information to expand their attack radius,” she said.

Dell’s disclosure could trigger phishing attempts against customers, even without personally identifiable information (PII) such as credit card numbers, Matchett said. Information such as hardware serial numbers, order details and addresses could lead a fraudster to look like a Dell service representative and spoof an email or phone call.

“Even though it may not be specifically personal information, it does make people more vulnerable to phishing attacks,” he said.

Tim McCarthy is a TechTarget Editorial news writer covering cloud and data storage.

Related Posts