Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

3/20/2020
06:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

200M Records of US Citizens Leaked in Unprotected Database

Researchers have not determined who owns the database, which was one of several large exposed instances disclosed this week.

Researchers discovered an unprotected database holding 800GB of personal user information, including 200 million detailed user records. The entirety of the database was wiped on March 3.

User records inside the database held what appeared to be profiles of US users, according to researchers with Lithuanian research group CyberNews. Data contained exposed individuals' full names and titles, email addresses, phone numbers, birthdates, credit ratings, home and mortgage real estate addresses, demographics, mortgage and tax records, and information about personal interests, and investments, as well as political, charitable, and religious donations.

"We were shocked by the sheer scale of the data exposed: The combination of personal, demographic and real estate asset data was an absolute goldmine for cybercriminals," the CyberNews team says.

It seems much of the data in this "main folder" may have originated in the United States Census Bureau, researchers report. When they found the database on Shodan.io in late January, they reached out to the US Census Bureau as a potential owner and have not heard a response. They watched the database for a couple of months, they say, but assume it was exposed for longer.

Finding the database was "not that difficult," the researchers say, but attackers would need some basic technical knowledge to understand what they were looking for. While someone could have accessed the database by mistake, the chances of this happening would be low.

In addition to the main folder of unsecured data, the database contained two more folders seemingly unrelated to the trove of personal records held in the main folder. These folders held the emergence call logs of a US-based fire department, as well as a list of some 74 bike stations that formerly belonged to a bike-share program. The bike-share stations are owned by Lyft.

While the two smaller folders did not hold personal data, the fire department call logs did have dates, time, locations, and other metadata dating back to 2010. "The presence of the folders that contained bike-sharing and fire department service call data was what confused us the most," they say. It's possible the data in these two folders may have been stolen or was used by several parties at the same time, the researchers hypothesize. They were unable to confirm this.

"The structure of the data led us to believe that the database belonged to a data marketing firm, or a credit or real estate company," the team says. For example, categories and sections were marked as codes in a fashion similar to the dictionaries used by data marketers. The codes themselves, they explain, were specific to the US Census Bureau or used in its classifications.

Information in this database, if accessed, could be "incredibly useful" to phishers, scammers, and other cybercriminals who could use the personal details within it to launch sophisticated phishing campaigns, spam attacks, and social engineering attempts.

This wasn't the only large misconfigured database found exposing sensitive information this week. Just yesterday, a misconfigured Elasticsearch database exposed more than 5 billion records related to data breaches between 2012 and 2019. A UK research firm collected detailed information on the breaches, including domain, source, contact email address, and password.

Earlier this week, vpnMentor researchers discovered an unprotected AWS S3 bucket holding 425GB of data, representing some 500,000 files related to MCA Wizard, a mobile app that acts as a tool for a Merchant Cash Advance. Data in the documents included credit reports, bank statements, contracts, legal documents, purchase orders, tax returns, and Social Security data.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Security Lessons We've Learned (So Far) from COVID-19."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
sakaarij2
50%
50%
sakaarij2,
User Rank: Apprentice
3/22/2020 | 12:39:04 AM
Comment on 200M Records of US Citizens Leaked in Unprotected Database
That was a very good article Kelly, I am not that technical but I see Data is the new gold as we are advancing in AI data is going to be the main target for hackers, I also learnt from this article single point of failure bound to happen in my opinion Blockchain technology will help to secure database. Thank you for sharing the wonderful article love to read more article and gain knowledge thank you again Kelly   
tdsan
50%
50%
tdsan,
User Rank: Ninja
3/26/2020 | 12:05:50 PM
Re: Comment on 200M Records of US Citizens Leaked in Unprotected Database
Wow, another breach where human error and misconfiguration played a role in 800 million records found on the Internet. The data privacy and the controls that were once supposed to be implemented are out of the door. AWS, Azure and GCP have put in measures to help with user error and oversight but it seems that it continues to happen. I am looking for GDPR or FTC to take a front seat to address this issue (sanctions and injunctions) but it seems that this will get brushed under the rug for someone's incompetence work. This is almost laughable but the sheer detail of informaiton found on the web, that had been monitoried months by a security team over the internet is sad. Someone's job or jail time needs to be involved because this PII infromation could be used for nefarious purposes that could affect the lives of citizens across the US (credit monitoring from Experian is not going to fix this, lol).

AWS S3 Bucket



I am trying to figure out why couldn't they do that on the various S3 buckets that were found in the public domain, just curious or someone from the inside set it up to make them look bad (disgruntled employee). I dont' put anything past emotional turmoil.

T

 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/27/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13643
PUBLISHED: 2020-05-28
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be e...
CVE-2020-13644
PUBLISHED: 2020-05-28
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accord...
CVE-2020-13641
PUBLISHED: 2020-05-28
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allow...
CVE-2020-13642
PUBLISHED: 2020-05-28
An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be e...
CVE-2020-8603
PUBLISHED: 2020-05-27
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or ...