“This highly sophisticated attack began on the Discord platform with the downloading of malware under cover of a game on the Steam platform, proposed by an acquaintance of our employee, himself a victim of the same attack.”
Shadow’s “highly sophisticated attack” was an employee installing a game a friend sent on Discord. That got the attacker into a SaaS provider’s admin panel and the names, emails, birth dates, billing addresses and card expiry dates of customers. The seller claims more than 530,000 records and says Shadow ignored him. Shadow told customers by email, posted nothing publicly and would not say how many people were hit.