Business consulting firm Frost & Sullivan Inc. has suffered a data breach and data stolen from the firm appeared for sale on a hacker forum.

The Mountain View, California-based company has a global presence with 40 offices across six continents. It offers services such as market research, analysis, growth strategy consulting and corporate training.

The data hack came to light after a hacking group known as “KelvinSecurity Team” offered data stolen from the company on a forum. Bleeping Computer reported today that the stolen data includes various databases relating to Frost & Sullivan employees and customers, in particular containing first and last names, login names, email addresses and hashed passwords.

The breach is said to have come about due to a misconfigured backup directory on a cloud server belonging to the company. SiliconANGLE has asked the comment but it has not yet responded.

In any case, the breach adds even more personal information to the dark web, a shady corner of the internet reachable with special software, Robert Prigge, chief executive officer of mobile payments and identity verification firm Jumio Corp., told SiliconANGLE.

“As some hashed passwords can be easily deciphered, cybercriminals can use this information to log in to Frost & Sullivan’s database as the employee, gaining access to client personal information and other employee details,” Prigge explained. “Because usernames and passwords were compromised, attackers can leverage bots and credential stuffing to try these stolen login credentials across thousands or hundreds of thousands of websites in search of an opening.”

Problem is, he added, that there’s no way for any online organization to confirm the authorized user is the one logging in. “Biometric authentication, using a person’s unique human traits to verify identity, is a more secure alternative to passwords, giving only the account owner access,” he advised.

Image: Visual Content/Flickr