A recent report by NordVPN’s NordPass password manager unveiled shocking facts about misconfigured databases. The researchers identified 9,517 unsecured databases with 10 billion records globally. Now, a US-based online marketing company called the View Media exposed almost 39 million user records due to an unsecured AWS S3 bucket.
The database was discovered by the CyberNews research team wherein, sensitive information such as full names, addresses, contact numbers, and zip codes were publicly accessible.
View Media is an online platform that caters to a range of digital marketing and advertising services. Such as email campaigns, display advertising, design, and hosting amongst others.
See: Hackers leak up to 4 TB of OnlyFans content for download
What’s worse is that the data was available on Amazon Web Services (AWS) server and could have been easily accessed and downloaded by threat actors.
The research team discovered the bucket on 29th July containing more than 5,000 files which included 700 work documents revolving around targeted and direct mail advertising campaigns saved in PDF format.
Moreover, 59 XLS and VSV files containing almost 39 million US citizen records (38,765,297) were also found, out of which a whopping 23,511,441 were unique entries.
The advertising campaigns were designed ensuing user locations and ZIP codes. Not only this, but the comprehensive drive included target demographics such as full names, home address, emails, contact numbers too.
According to CyberNews’s report, apart from this, the AWS bucket also showcased View Media’s promotional materials such as banners, newsletters, and flyers created for clients. The latter actually helped researchers identify the company in question.
It is noteworthy that the AWS server could have been exposed for an unknown time period and the researchers are still perplexed whether the data has been downloaded by cybercriminals or not.
The incident should not come as a surprise since misconfigured databases have exposed billions of sensitive records in the last couple of years. In fact, the situation is so critical that according to a new poll database configuration errors are the number one threat to cloud security.
See: 201 million US demographic, personal records leaked online
Nevertheless, the exposed records may not have contained sensitive information, but the details could have easily targeted users for fraudulent schemes. Exposed phone numbers and email addresses are common gateways for phishing campaigns. Not only this, but conniving threat actors could easily combine data and build profiles for identity theft.
If its any consolation, the security team contacted Amazon on the 27th of July and they were able to secure the database in two days.
Unfortunately, instances of unsecured databases emerge every now and then. Only recently a New York-based artificial intelligence company called Cense exposed 2.5 million medical records containing sensitive yet confidential user records due to database misconfiguration. The unprotected medical records included Personally Identifiable Information (PII), patient names, insurance records, diagnosis, and payment information.
Did you enjoy reading this article? Do like our page on Facebook and follow us on Twitter.