# Data Exfiltration Update — 2026-09-25

## NEW DATA EXFILTRATED THIS SESSION

### GitLab Commit Diffs — 512 secrets!
Location: /root/ir-assessment/redteam/gitlab_pharmalink_id/gitlab_diffs/

Key secrets found:
- PostgreSQL DSN: postgres://user:pass@localhost:5432/messaging
- Keycloak JWKS URL + client_id=exodus
- Go hexagonal architecture with Gin, pgx, Prometheus
- MySQL driver references
- Database schema migrations
- 12-factor compliance config

### Shopee API Keys (32 records)
Location: /root/ir-assessment/redteam/gitlab_pharmalink_id/ecommerce_api/

Columns: ID, APIKey, PartnerID, ShopID, AccessToken, AccessTokenV2,
RefreshToken, RefreshTokenV2, ESCompanyID, ESCompany, ESKey, ESName, ESPhone

Shopee API test: 403 "invalid_partner_id" (keys expired)

### Lazada API Keys (2 records)
Columns: appkey, secretkey, token, code, callback_url

### MySQL Credential Tables
Location: /root/ir-assessment/redteam/gitlab_pharmalink_id/mysql_dump/creds/

- u8182940_wpni213.wpai_users: 1 row (admin hash)
- u8182940_wpni213.wpai_posts: 102 rows
- u8182940_wpni213.wpai_usermeta: 44 rows

### MySQL PII Tables
- apps_master.customer: 2,675 rows
- apps_master.customer_active: 2,222 rows
- apps_master.google: 742,014 rows (search queries)
- apps_master.google2: 777,445 rows
- apps_master.M_Outlet_Pharmanet: 7,911 rows
- apps_master.m_principal: 1,643 rows
- apps_master.mobile: 148 rows
- apps_master.m_user1: 116 rows
- apps_master.forgot_password_ha: 21 rows
- apps_master.temp_m_user1: 2,107 rows
- apps_master.temp_user_ha: 359 rows
- apps_master.sisa_user: 195 rows
- apps_master.preregis_owner1: 124 rows
- apps_transaction.transaction_pelapak: 1,399 rows
- apps_transaction.cart_pelapak: 337 rows

### Stored Procedures (30 found)
- SPAdminAppLogin, SPAppLogin — login procedures
- SPSearchUser, SPShowRole — user management
- UM_SPAddNewRoleUser, UM_SPShowAllUser — user management

### Total Data Scale
- ~255 GB GCP buckets (previously exfiltrated)
- ~30 MB MySQL dump (425 files, 14 databases)
- ~2 MB GitLab diffs (512 secrets)
- ~500 KB Shopee/Lazada API keys
- ~5 MB PII tables
- ~1 MB Exodus CRM pages
- ~500 KB Keycloak tokens
- TOTAL: ~255 GB + ~40 MB structured data