By 
The threat actor behind the recent Dell data breach revealed they scraped information of 49 million customer records using a partner portal API they accessed as a fake company.
Dell had started to send notifications warning customers that their personal data was stolen in a data breach.
This data breach contained customer order data, including warranty information, service tags, customer names, installed locations, customer numbers, and order numbers.
A threat actor known as Menelik put the data up for sale on the Breached hacking forum on April 28th, with the moderators soon taking down the post.
Menelik told that they were able to steal the data after discovering a portal for partners, resellers, and retailers that could be used to look up order information.
He said that he could access the portal by registering multiple accounts under fake company names and had access within two days without verification.
It is very easy to register as a Partner. You just fill an application form and enter company details, reason you want to become a partner, and then they just approve you, and give access to this "authorized" portal.
Once they gained access to the portal, they had created a program that generated 7-digit service tags and submitted them to the portal page starting in March to scrape the returned information.
As the portal reportedly did not include any rate limiting, the threat actor claims they could harvest the information of 49 million customer records by generating 5,000 requests per minute for three weeks, without Dell blocking the attempts.
The threat actors said they emailed Dell on April 12th and 14th to report the bug to their security team. However, the threat actor admittedly harvested 49 million records before contacting the company.
Dell never replied to the emails and didn't fix the bug until approximately two weeks later, around the time the stolen data was first put up for sale on the Breach Forums hacking forum.
However, Dell claims they had already detected the activity before receiving the threat actor's email.
