Vulnerabilities / Threats

6/28/2018
11:33 AM
50%
50%

Newly Revealed Exactis Data Leak Bigger Than Equifax's

Marketing data firm left its massive database open to the Internet.

What happens when you leave a database filled with personal information open to the Internet? People find it: That's what happened to marketing data firm Exactis with its database of information on roughly 340 million people.

Security researcher Vinnie Troia of Night Lion Security discovered the database through a Shodan search. Exactis is a marketing data company that provides companies with the sort of information needed to target ads to people browsing the Web.

Troia told Wired, "It seems like this is a database with pretty much every US citizen in it," adding, "I don't know where the data is coming from, but it's one of the most comprehensive collections I've ever seen."

While the data did not include credit card or social security numbers, it did include everything from political preferences to browsing and purchase data for a wide variety of items. Taken together, the pieces of information would allow an advertiser or database user to form a very detailed picture of the targeted individual.

"The data reported to have been leaked is incredibly comprehensive and can be used by hackers to develop more targeted phishing scams," said John "Lex" Robinson, cybersecurity strategist at Cofense. "Phishing is a serious threat because it works, with personalized phish often making their way past stacks of expensive technology layers and email gateways to land in an unsuspecting user's inbox."

In terms of size, the Exactis leak dwarfs the Equifax breach, which exposed nearly 146 million records. Exactis has now taken the database off the public Internet, but has made no public statement on the affair. At the time of this article's publication, the company's website was down, with a request returning a 508 error.

For more, read here and here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
To Click or Not to Click: The Answer Is Easy
Kowsik Guruswamy, Chief Technology Officer at Menlo Security,  11/14/2018
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19279
PUBLISHED: 2018-11-14
PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater.
CVE-2018-19280
PUBLISHED: 2018-11-14
Centreon 3.4.x has XSS via the resource name or macro expression of a poller macro.
CVE-2018-19281
PUBLISHED: 2018-11-14
Centreon 3.4.x allows SNMP trap SQL Injection.
CVE-2018-17960
PUBLISHED: 2018-11-14
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
CVE-2018-19278
PUBLISHED: 2018-11-14
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed lengt...