Researchers have discovered another big database containing millions of European customer records left unsecured on Amazon Web Services (AWS) for anyone to find using a search engine.
A total of eight million records were involved, collected via marketplace and payment system APIs belonging to companies including Amazon, eBay, Shopify, PayPal, and Stripe.
Discovered by Comparitech’s noted breach hunter Bob Diachenko, the AWS instance containing the MongoDB database became visible on 3 February, where it remained indexable by search engines for five days.
Data in the records included names, shipping addresses, email addresses, phone numbers, items purchased, payments, order IDs, links to Stripe and Shopify invoices, and partially redacted credit cards.
Also included were thousands of Amazon Marketplace Web Services (MWS) queries, an MWS authentication token, and an AWS access key ID.
Because a single customer might generate multiple records, Comparitech wasn’t able to estimate how many customers might be affected.
About half of the customers whose records were leaked are from the UK; as far as we can tell, most if not all of the rest are from elsewhere in Europe.
How did this happen?
According to Comparitech, the unnamed company involved was a third party conducting cross-border value-added tax (VAT) analysis.
That is, a company none of the affected customers would have heard of or have any relationship with:
This exposure exemplifies how, when handing over personal and payment details to a company online, that info often passes through the hands of various third parties contracted to process, organize, and analyze it. Rarely are such tasks handled solely in house.
Amazon queries could be used to query the MWS API, Comparitech said, potentially allowing an attacker to request records from sales databases. For that reason, it recommended that the companies involved should immediately change their passwords and keys.
Amazon began investigating the breach on the day it was disclosed to them with the third-party company involved shutting down the database on 8 February.
While there is no evidence anyone accessed the data during the days it was left unsecured it is impossible to be sure of that.
It’s simply the latest example of how easy it is to leave sensitive data sitting in an unsecured state on cloud storage platforms.
Previous examples discovered by Comparitech and Diachenko include:
- A total of 250 million Microsoft customer support records dating back to 2005 left exposed on Elasticsearch.
- A database containing 267 million Facebook user IDs, phone numbers and names left exposed on Elasticsearch.
- An email database of 5 million Adobe Creative Cloud customers left exposed in an Elasticsearch server (October 2019).
- The personal details of 57 million Americans left on a marketing database on Elasticsearch.
The number of these breaches seems to be growing in scope and number in the last year. The current defence against them right now is simply that researchers publicise them before the criminals do. That needs to change before real damage is done.
LEARN MORE – WATCH NOW ON OUR YOUTUBE CHANNEL
(Watch directly on YouTube if the video won’t play here.)
Latest Naked Security podcast
LISTEN NOW
Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.