Last week, a hacking group named “NullBulge” unleashed a massive 1.1 TB data leak, claiming it to be Disney’s internal Slack archive. This trove allegedly contains messages and files from nearly 10,000 channels, including unreleased projects, code, images, login credentials, and links to internal sites and APIs. According to WIRED, the hackers received the data from an insider, whom they have named publicly. Disney has responded minimally, telling the Wall Street Journal that they are “investigating.”
The data first appeared on BreachForums on Thursday but was quickly taken down. However, it continues to circulate on mirror sites. Roei Sherman from Mitiga Security confirmed the authenticity of the leak, stating it includes URLs, employee chats, credentials, and more. Sherman notes that breaches like this are common, particularly through cloud and SaaS platforms.
NullBulge positions itself as a protector of artists’ rights, targeting entities they accuse of promoting cryptocurrency, pushing AI-generated art, or stealing from artists. Their website showcases previous attacks, including one on Indian content creator Chief Shifter. In their Disney breach, they also leaked the supposed insider’s medical records and password manager contents, though this person’s involvement remains unconfirmed.
Corporate Slack accounts are prime targets for attackers, and Sherman warns that Disney may face further breaches as a result of this leak. This incident underscores the ongoing vulnerability of major companies to cyberattacks, especially through internal communication platforms.
Stay tuned for updates as this situation develops and more information becomes available.
