Saudi Government Portal: Pryx Exploits IDOR to Leak 40GB of Citizen Data
On August 27, 2024, threat actor Pryx published approximately 40 gigabytes of data exfiltrated from saudi.gov.sa, the Saudi government's central services portal. The data included scanned national ID cards, driver's licenses, work CVs and resumes, and private email attachments.
Pryx exploited an Insecure Direct Object Reference (IDOR) vulnerability caused by poor cookie management. Pryx was later unmasked as a co-founder of the Hellcat ransomware group. The breach occurred 18 days before PDPL enforcement.
01
KEY FACTS
- .What: Threat actor Pryx exploited IDOR to leak 40GB from saudi.gov.sa.
- .Who: Saudi citizens who uploaded documents to the government portal.
- .Data Exposed: National ID scans, driver's licenses, CVs, and email attachments.
- .Outcome: Occurred 18 days before PDPL enforcement; Pryx unmasked as Hellcat co-founder.
02
SOURCES
Resecurity, BleepingComputer, Dark Reading, Saudi PDPL