Fake Hard Drive Sales: A Cautionary Tale

In January 2025, German tech publication Heise covered a sinister trend: heavily used hard drives being resold as “new” devices. As the number of reported cases increased, it became clear that bad actors had tampered with hard drives to hide their history and level of use. The response to the fake hard drive sales was swift, with manufacturers working with authorities to identify the culprits. 

According to Horizon COO Stephen Buckler, this event was “a wake-up call for individual consumers and procurement teams alike.”

“Avoiding situations like the fraud discovered in January requires some due diligence on the part of the consumer. As a rule of thumb: if it seems too good to be true, it probably is.”

Here we break down the tampered drive debacle and provide tips for doing due diligence when searching for cost-effective drives. The bottom line: purchasing drives from approved vendors is the most effective way to ensure quality.

The Hard Drive Caper Begins

The fraudulent drive story broke in late January 2025. Heise ran a story about a customer who bought two new 14TB Seagate Exos drives from a German online retailer. The drives had some minor damage to the casing but seemed otherwise normal. The Self-Monitoring, Analysis, and Reporting Technology (SMART) stats revealed no issues. 

However, when tested again for Field Accessible Reliability Metrics (FARM) values (Seagate’s additional log of parameters for its server drives), the two drives showed 10,000 & 15,000 hours of use. This raised the customer’s suspicion, so he ordered replacement drives from a different dealer. Unfortunately, the FARM stats of the replacement drives revealed a runtime of 22,000 hours.

Soon, Heise received reports from over 200 affected customers, with cases surfacing in places like Switzerland, Japan, Australia, UK, and the US. Further reports indicated that the fraud was not limited to Seagate’s Exos HDDs, but also affected the firm’s Ironwolf and Ironwolf Pro HDDs. A mystery was afoot!

Origin and Scope of the Fraud

Crypto-collector culprits, perhaps? Initial evidence suggested that the tampered drives originated in China, where they were used to obtain Chia coin. Chia is a hard drive based crypto ecosystem which uses spare storage space to “farm” cryptocurrency (the Chia equivalent of bitcoin mining). In 2024, Chia cut its rewards for farming in half, and its netspace gradually decreased from 34EB to 19EB due to waning interest. As a result, many drives previously used in the farming process were illicitly resold.

Given Seagate’s 40% market share of the hard drive market, Heise estimates as many as 400,000 16TB Seagate drives from Chia farming operations could be in circulation.

Announcing a thorough investigation, Seagate issued an official statement recommending that the resellers purchase drives only from authorized distributors. The firm backed this up by updating its partner program to contractually obligate partners to use these distributors exclusively. Finally, Seagate introduced a Global Trade Screening (GTS) process to detect and block potentially suspicious suppliers listed on the GTS sanction list.

While affected customers were able to get refunds, restoring trust is harder. “The recent fraud isn’t just an issue for consumers,” says Buckler. “Since fraud harms trust, this is also an issue for honest resellers, who can suffer reputational risk as collateral damage.”

Nonetheless, a savvy seller builds confidence by providing evidence of product quality. “That’s the point of ‘certified’ in recertified drives,” he continues. “We carefully document the testing status and ownership history of hardware so customers know what they’re buying.”

The Breakthrough: A Counterfeit Drive Workshop

In May, acting on a tip from a local manager, Malaysian authorities carried out a raid at a clandestine warehouse in Kuala Lumpur. Conducted in collaboration with Seagate security staff, the raid uncovered about 700 HDDs. Investigators found suspects resetting internal drive statistics, as well as cleaning and repackaging the HDDs before inserting them for sale into local e-commerce platforms. 

In addition to Seagate drives, tampered devices from Kioxia and Western Digital were discovered in the warehouse. While investigators previously suspected that devices from other OEMs had been modified, it had proved difficult to verify, as not all drives include an equivalent of Seagate’s FARM values.

Tampering with Stats

SMART attributes include information such as drive temperature, start/stop count, power-on hours, etc. As confirmed by Seagate, these SMART attributes can be reset, making the fraudulent drives show run-times of a few hours instead of the actual run-times (15,000 to 50,000 hours!) revealed by the FARM attributes.

There’s a further complication for fraud detection: Heise reported altered FARM values in some of the fraudulent drives. FARM logs give an overview of drive health and usage by using data from several internal logs. Bad actors found a way to delete/reset the logs that FARM values depend on, concealing the number of hours of operation.

Physical Tampering

The sophisticated operation extended to physical modification, with fraudulent drives given new labels and QR codes. Instead of linking to a verification page that identifies drives by serial number and storage capacity, the new QR codes redirected to a warranty check page.

Relabeling

In addition to technical manipulation, some HDDs were re-labeled to increase their market value. For instance, Barracuda drives were presented as higher workload models, such as the IronWolf or SkyHawk series.

Avoiding Counterfeit Drives

The takeaway from our cautionary tale is this: hard drive fraud is becoming more sophisticated. To reap the cost benefits of resold hardware, you need ways to evaluate resellers and spot tampered drives.

Check SMART and FARM stats

Smartmontools is a stats monitor that can be used to gauge drive runtimes. While SMART stats can be tampered with, it’s still a good idea to check these stats as a first pass.

You should also check FARM values, which are harder to adjust. (However, with enough know-how it is possible to alter the FARM stats as well. Besides, FARM detection may also not work for every Seagate device, not to mention devices from other OEMs.)

Check physical signs

If the drive has seen heavy use, it may show some wear on the drive body. Look for dents or scratches on the casing or abrasions on the SATA connectors. In some cases, the sticker is stuck too low, which doesn’t happen with officially placed drive labels. If the drive is missing a front sticker, that’s a red flag.

Check Dates and Serial Numbers

HDDs usually reach the end user within six months of production. If a supposedly new drive has a production date more than six months old, then it is worth examining the drive more closely.

The warranty date can also provide a clue to the drive’s authenticity. In some cases, bad actors used serial numbers from different in-warranty drives to deceive buyers. While fraudulent drives often show a “warranty” ending exactly five years from the production date, OEMs like Seagate usually add a few extra months to account for the time the drive may take to reach the customer.

Missing info is another red flag: altered warranty QR codes on the drive sometimes redirect the customer to a blank warranty page without the drive’s serial number and dates filled in. 

Stick with authorized distributors.

To get trustworthy drives, purchase from trustworthy resellers. When buying from verified vendors, you don’t need to take their word for it: they will provide you with detailed tracking information. 

“The challenge is demonstrating reliability. Drives recertified by OEMs have labels, but as the fraud case shows, these can be faked”, Buckler explains. In his view, the solution is a digital paper trail.

When buying from a factory authorized distributor, ask for documentation verifying the authorized status. If buying reused drives, ask for serialized test reports and make sure to sample test drives to validate results.

“We offer a full supply chain of custody for our drives, a chain that goes all the way back to Seagate,” he continues. “This is Seagate’s own preferred method of demonstrating reliability: they have encouraged consumers to only make purchases via authorized resellers.”

“When it comes to avoiding fraud, the ‘who’ matters as much as the ‘what’. To know what you’re buying, know who you’re buying from: a reputable vendor can provide the tracking information and test reports that demonstrate the quality of the product they’re selling.”

Verification Is Paramount

The recent cases of fraudulent hard drive sales underscore the need for due diligence when making purchases. “If there is any moral to the fake hard drive saga, it is that you should always perform the necessary checks and verifications when purchasing reused or recertified HDDs,” says Buckler.

While OEM policies aim to further curb such frauds, awareness remains the main key to avoiding bad deals. Simple measures such as purchasing through verified channels, inspecting the drive health and status, and checking for signs of physical tampering can help buyers avoid fraudulent drives.

Of course, not all fraudulent drives will carry obvious red flags. This is where trustworthy resellers come in: authorized distributors should be able to back up drive authenticity with a clear paper trail. By vetting distributors themselves, you can identify trusted channels to help navigate the market for drives.

Horizon is an authorized distributor of Seagate recertified drives, having worked with Seagate for more than 25 years. Get in touch to find out how to buy drives in bulk for your storage needs.