Anonymous Breach of Stratfor Exposed Customer Data and Millions of Internal Emails

Anonymous-affiliated attackers breached private intelligence firm Stratfor, stealing subscriber records, payment data, and a vast archive of internal correspondence. Reporting on the intrusion said the attackers accessed administrative systems, expanded into databases and mail servers, and exfiltrated data affecting about 860,000 user accounts and more than 60,000 credit cards; some reports said card numbers were stored in plaintext, while passwords were protected with weak unsalted MD5 hashes. The attackers defaced Stratfor’s website, deleted server contents, published stolen card data, and used some of the payment information for fraudulent charitable donations, contributing to losses that reports put at at least $700,000 and broader damages of roughly $2 million.

The breach escalated when WikiLeaks began publishing roughly 5 million Stratfor emails, exposing the firm’s client relationships, source-handling practices, monitoring of activist groups, and sensitive geopolitical claims contained in internal messages. Subsequent reporting said the FBI had visibility into parts of the operation through informant Hector Xavier Monsegur ("Sabu") and later built its case against alleged participant Jeremy Hammond, while Stratfor faced delayed customer notification and legal fallout. Years later, researchers also warned that some documents in the leaked Stratfor archive contained live malware, including files exploiting CVE-2010-3333, creating additional risk for journalists and researchers who downloaded the material.