A database hosted on Amazon Web Services (AWS) and owned by Dow Jones has accidentally been exposed putting approx. 2.4 million corporate entities and individuals at risk of data theft.
Reportedly, the exposed database comprises sensitive information about terrorists, criminals, and shady businesses. The culprit in this incident is an incorrectly configured and poorly secured Elasticsearch database on AWS.
See: Abine Blur Password Manager exposed data of 2.4M users
Security researcher Bob Diachenko has discovered this database; he’s the same researcher who previously discovered Veeam, Nokia, Fasten, and Elasticsearch, etc. data breaches.
According to Diachenko, the now removed watchlist was available on a public cloud server in an Elasticsearch cluster that was 4.4GB in size. Anyone having some information about how to find the database can access it.
Basically, the watchlist consists of companies and people used by Dow Jones’ customers for their compliance screening. For your information, when companies carry out business activities with such entities, there are probabilities of adverse outcomes in case they are found to be under official sanctions. Therefore, financial firms like Dow Jones create such watchlists so that they couldn’t be fooled by such shady people or firms and land them into trouble.
The database contains private data such as name, age, photographs, physical location, government filings, news reports, and UN and EU data. It also contains the information of government officials and politicians from around the world.
“What makes this data so much more valuable is the focus on premium and reputable sources. In the age of fake news and social engineering online it is easy to see how valuable this type of information would be to companies, governments, or individuals,” explained Diachenko.
According to Dow Jones’ spokesperson, the database is part of their risk and compliance process and the information has entirely been derived from public sources.
“This dataset is part of our risk and compliance feed product, which is entirely derived from publicly available sources. At this time our review suggests, this resulted from an authorized third party’s misconfiguration of an AWS server, and the data is no longer available.” the spokesperson told HackRead.
See: Sensitive data on 31,000 GoDaddy servers exposed online
This isn’t the first time that an unsecure database hosted on AWS server has resulted in massive data exposure. Previously, Cadastro de Pessoas Físicas (CPFs) of 120 million Brazil citizens were leaked online due to the same reason.
Article updated on March 4th, 2019 with a statement from Dow Jones.
Did you enjoy reading this article? Kindly do like our page on Facebook and follow us on Twitter.