While cloud computing is helping organizations in advancing their operations, data leaks due to cloud misconfigurations are giving nightmares to businesses. A threat analysis from cybersecurity research firm WizCase revealed a data breach that affected Reindeer, an American marketing enterprise. The now-defunct company provides digital marketing services to a vast number of clients across the globe. The security incident could have affected thousands of users’ sensitive information.
Information Exposed
Security experts at WizCase discovered a misconfigured Amazon S3 bucket that belonged to Reindeer, which contained over 50,000 files, totaling 32GB of data. The bucket is not password protected, allowing anyone to access the data. The exposed information included usernames, surnames, date of birth, email addresses, profile pictures, hashed passwords, Facebook IDs, residential details, and contact numbers of over 300,000 customers from various Reindeer clients. Most of the affected users in the breach are from the U.S., Canada, and the U.K.
“We reached out to Amazon regarding the breach. As the bucket is owned by a now-defunct company, the web host is the only contact we could find to help secure the breach. We also informed the US-Cert, hoping they would be able to reach out to the previous company owner,” WizCase said.
Accidental or Pure Negligence
Organizations should protect their customers data in the cloud even if they are going out of business. The sensitive information should be taken off from cloud infrastructures to avoid potential risks.
“This breach shows a concerning lack of due diligence on Reindeer’s part. While they seemed to have ceased working with these brands by 2014 at the latest, they still had access to all this sensitive information from hundreds of thousands of users and did not sufficiently secure it after the company’s closure. Even when a company goes out of business, it still possesses responsibilities to its users and its client’s users to keep their data safe,” WizCase added.
Risks Associated with the Data Breach
Cybercriminals could leverage the leaked data to launch various cyberattacks including:
- Vishing and Phishing attacks
- Identity theft
- Social engineering attacks
- Brute force attacks
- Trading the leaked data on darknet markets
Threat actors are always on the lookout for sensitive information online. It’s recommended to give only the required information on social media handles and while making online purchases.
Related Story:
