The hacker who perpetrated the theft is known by the Twitter handle @0x2Taylor, and apparently the stolen data was posted multiple times over the past weekend. The data was quickly removed each time, but it included complete names, IP addresses, dates of birth, email addresses, vehicle data, and occupations. In other words, the data would be incredibly helpful for conducting further, highly individualized attacks such as identity theft.

Perhaps worst, the breach was made possible due to the use of an obvious attack vector. MBS was using an open MongoDB database, and apparently all that was needed for the attack to occur was for the IP address of that database to be communicated online. Rather than informing MBS of the security issue, whoever found the database leaked it to acquaintances instead. From there, the attack was both simple and straightforward.

At this point, there’s some confusion as to the actual number of records that were released. While it’s at least 58 million, it could be as many as 258 million based on an analysis of the database involved. While research is ongoing, it’s entirely possible that we’ll never know exactly how much data was released and who was affected.

Normally we would give various recommendations about being aware of where your personal data is being stored and to respond appropriately to any notifications of a data breach. In this case, there’s not much you can do except invest in a credit and data monitoring service of some sort to make sure you’re generally protected — because you never know when you might be attacked and not even know it.