Dell hacker claims they had access to systems for nearly three weeks

By Solomon Klappholz, IT Pro

The hacker trying to sell a Dell database containing 49 million customer records claims he was able to persist on the company’s systems for several weeks

The threat actor behind the recent Dell data breach that exposed 49 million customer records claims they were able to access internal systems for weeks before being discovered. 

The hacker, Menelik, was reported to be selling access to a database storing 49 million records related to systems purchased from Dell between 2017 and 2024.

Dell disclosed the breach on 9 May, notifying customers that their names, addresses, and Dell customer info were exposed, warning them to watch out for social engineering attacks impersonating the technology giant.

Menelik told TechCrunch they were able to gain access to the database by registering several accounts on a Dell portal as a partner that resells Dell products and services.

According to Menelik, the process of registering and being approved as a partner was relatively simple and did not require verification, with a potential hacker only needing to enter a set of company details and give a reason for wanting to become a partner, and Dell will approve you in under two days.

After Dell approved the new partner accounts, he then brute-forced customer service tags over the course of 3 weeks by spamming requests to a database storing sensitive information, all without Dell noticing.

“[I] sent more than 5,000 requests per minute to this page that contains sensitive information. Believe me or not, I kept doing this for nearly 3 weeks and Dell did not notice anything. Nearly 50 Million requests…After I thought I got enough data, I sent multiple emails to Dell and notified the vulnerability. It took them nearly a week to patch it all up,” Menelik told TechCrunch.

The cyber criminal added that he stopped scraping at some point and thus did not obtain the complete database with customer data, but was still able to demonstrate to the publication that the data was legitimate by cross-referencing the database with information of customers who received the breach notification from Dell – with their permission.