\n<\/p>\n
On Sunday, a user in a well-known hacking forum advertised what they claimed was a cache of stolen data from the rental car giant Europcar. The user claimed to have stolen the personal information of more than 48 million Europcar customers, and said they were \u201clistening to offers\u201d to sell the hacked data.<\/p>\n
Except, the data appears to be completely made up \u2014 perhaps created with ChatGPT, according to Europcar.<\/p>\n
Europcar spokesperson Vincent Vevaud told TechCrunch that the company investigated the alleged breach after a threat intelligence service alerted it to the forum advertisement.<\/p>\n
\u201cThoroughly checking the data contained in the sample, we are confident that this advertisement is false,\u201d Vevaud said in an email, adding:<\/p>\n
\n\u2013 The number of records is completely wrong & inconsistent with ours,<\/p>\n
\u2013 The sample data is likely ChatGPT-generated (addresses don\u2019t exist, ZIP codes don\u2019t match, first name and last name don\u2019t match email addresses, email addresses use very unusual TLDs),<\/p>\n
\u2013 And most importantly, none of these email addresses are present in our customer database.<\/p>\n<\/blockquote>\n
The hacking forum user told TechCrunch in an online chat that \u201cthe data is real,\u201d without supporting that statement with any evidence.<\/p>\n
In the forum post, the user claimed the data included usernames, passwords, full names, home addresses, zip codes, birth dates, passport numbers, and driver license numbers, among other data.<\/p>\n
The sample of data posted online, however, does not appear to be legitimate, not only according to Europcar, but also according to Troy Hunt, who runs the data breach notification service Have I Been Pwned<\/a>, as well as a TechCrunch analysis of the data.<\/p>\n
\u201cFirstly on the legitimacy of the data, a bunch of things don\u2019t add up. The most obvious one is that the email addresses and usernames bear no resemblance to the corresponding people names,\u201d Hunt wrote on X<\/a> (previously Twitter.)<\/p>\n
Hunt also added that many of the alleged home addresses are fake and \u201cjust don\u2019t exist.\u201d<\/p>\n
The forum user did not respond when asked to explain Hunt\u2019s observations.<\/p>\n
At the same time, Hunt is also skeptical that the data was created with ChatGPT.<\/p>\n
\u201cWe\u2019ve had fabricated breaches since forever because people want airtime or to make a name for themselves or maybe a quick buck. Who knows, it doesn\u2019t matter, because none of that makes it \u2018AI,\u2019\u201d Hunt wrote.<\/p>\n
Europcar\u2019s Vevaud did not immediately respond to questions on how the company determined the data was generated with ChatGPT.<\/p>\n
When TechCrunch asked ChatGPT to create \u201ca dataset of fake stolen personal data,\u201d the chat bot responded that it could not assist in \u201cin creating or promoting any illegal or unethical activities.\u201d<\/p>\n
While it\u2019s nearly impossible to confidently establish that the fake data was created with ChatGPT or a similar text-generating AI platform, it is feasible that one day hackers will use these tools to create large datasets of fake data.<\/p>\n<\/p><\/div>\n