All news in category "Incidents and Data Breaches"

Robotics Vendor Leak Exposed Manufacturing Secrets Worldwide

🔒 The UpGuard Cyber Risk team found an open rsync server owned by Level One Robotics that exposed 157 GB of files for more than 100 manufacturing customers, including major automakers. Exposed materials included factory CAD schematics, robotic configurations, NDA texts, VPN and badge request forms, employee ID scans, and corporate financial records. After notification, Level One closed the exposure promptly.

Public S3 Leak Exposed 1.86M Chicago Voter Records

🔓 UpGuard’s Cyber Risk Team discovered a publicly accessible AWS S3 repository tied to Election Systems & Software (ES&S) that contained multiple backups and a 12 GB MSSQL database. The data set included about 1.864 million Chicago voter records with names, addresses, dates of birth, phone numbers, driver’s license numbers and partial Social Security numbers. The bucket, labeled “chicagodb,” was found on August 11, 2017; ES&S was notified and the exposure was secured by August 12, 2017. This incident highlights vendor misconfiguration risk and the need for rigorous vendor risk management and configuration checks.

Medcall S3 Misconfiguration Exposed Patient Medical Records

🔓 An UpGuard analyst discovered an unsecured Amazon S3 bucket belonging to Medcall Healthcare Advisors that publicly exposed roughly 7 GB of sensitive data. The datastore included intake PDFs, audio and video recordings of patient-operator-doctor calls, and CSV files containing full Social Security numbers and other PII. The bucket's ACL granted 'Everyone - Full Control', allowing anonymous read/write access and permission changes. Medcall closed the bucket after notification on August 31.

ISP Exposes Admin Credentials via Misconfigured S3 Bucket

🔒 The UpGuard Cyber Risk team discovered a 73 GB dataset belonging to Washington ISP Pocket iNet publicly exposed in a misconfigured Amazon S3 bucket named pinapp2. The exposed files included plain text administrative passwords, AWS access keys, network diagrams, device configurations, inventories, and photographs of physical infrastructure. UpGuard notified Pocket iNet on discovery (October 11, 2018); the bucket remained exposed for seven days and was secured on October 19 after repeated contact. The incident highlights the dangers of storing secrets in public object storage and recommends using secrets managers, encryption, and hardened S3 ACLs.

Public S3 Exposure Tied to Booz Allen and NGA Incident

🔒 UpGuard’s Cyber Resilience Team discovered a publicly exposed Amazon S3 repository containing plaintext SSH keys and administrative credentials tied to a Booz Allen engineer and contractor metadata pointing to NGA‑related projects. After initial notification to Booz Allen, UpGuard escalated the issue to the NGA, which secured the repository within minutes. Booz Allen acknowledged the report later that day, and UpGuard preserved the downloaded dataset at the government’s request. The incident highlights the real‑world risk of simple misconfiguration and third‑party vendor security posture.

Public Exposure of GoDaddy AWS Configuration Data Details

🔍 The UpGuard Cyber Risk Team discovered a publicly readable Amazon S3 bucket containing spreadsheets that appeared to describe GoDaddy infrastructure running in the AWS cloud. The largest file listed more than 24,000 hostnames and 41 configuration fields, including hostname, OS, workload, region, vCPU, memory and modeled cost data, plus apparent AWS discount information. While the files did not contain credentials or end-user data, they effectively mapped a large-scale cloud deployment and revealed sensitive pricing details. UpGuard notified GoDaddy, and the exposure was closed after coordination with the company.

Verizon Cloud Leak: NICE Systems Exposed Customer Data

🔓 UpGuard discovered an Amazon S3 repository owned by NICE Systems that left call-support logs for Verizon publicly accessible. The exposed files contained names, addresses, phone numbers, account details and many unmasked account PINs tied to phone numbers, creating a significant risk of account takeover. UpGuard notified Verizon and the bucket was secured; the incident highlights third-party cloud misconfiguration risk and the need for stronger vendor controls.

TigerSwan S3 Exposure: Thousands of Resumes Leaked

🔓 UpGuard's Cyber Risk Team discovered an Amazon S3 bucket named "tigerswanresumes" that was publicly accessible, exposing 9,402 resumes and application documents submitted to TigerSwan. The files contained contact details, work histories, and sensitive identifiers — including passports, partial Social Security numbers, driver’s license numbers, and 295 resumes claiming Top Secret/SCI clearances. UpGuard notified TigerSwan and followed up repeatedly; the bucket remained accessible for roughly a month before it was secured. TigerSwan said the exposure resulted from a former recruiting vendor.

Maryland JIA NAS Misconfiguration Exposes PII, Credentials

🔒 The UpGuard Cyber Risk Team discovered a publicly exposed, misconfigured NAS belonging to the Maryland Joint Insurance Association (JIA) that contained backup customer and operational files. The repository included full Social Security numbers, bank account and check images, insurance policy data, and plaintext administrative credentials including remote access and third-party ISO ClaimSearch logins. UpGuard notified JIA on discovery; the exposure was secured and is no longer active.

Misconfigured Amazon S3 Exposed Tea Party Campaign Data

🔓 On August 28, 2018 the UpGuard Cyber Risk team discovered a publicly readable Amazon S3 bucket named tppcf containing roughly 2GB of campaign files belonging to the Tea Party Patriots Citizens Fund (TPPCF). The data included call lists with full names and phone numbers for about 527,000 individuals, along with strategy documents, call scripts, and marketing assets. UpGuard notified TPPCF on October 1; permissions were briefly set to allow global authenticated users and then removed by October 5. The incident illustrates how cloud misconfiguration can expose sensitive political microtargeting data and create significant privacy risks.

Phishers Target Aviation Executives, Steal Customer Funds

📧 A targeted phishing campaign compromised an aviation executive’s Microsoft 365 credentials, allowing attackers to mine past invoice conversations and send convincing fake invoice requests to customers. Within hours the fraudsters registered a near‑identical domain and at least one customer paid a six‑figure phony invoice. Investigation links the registration details to a long‑running Nigerian BEC ring identified as SilverTerrier; firms are urged to combine employee training, domain monitoring and rapid use of the Financial Fraud Kill Chain to improve recovery chances.

Google Files Lawsuit to Dismantle BadBox 2.0 Botnet

🔒 Google has filed a lawsuit in New York federal court targeting the operators of the BadBox 2.0 botnet, which compromised over 10 million uncertified devices running the Android Open Source Project. In partnership with HUMAN Security and Trend Micro, Google’s Ad Traffic Quality team identified preinstalled malware used for large-scale ad fraud and other illicit activity. Google updated Play Protect to automatically block BadBox-associated apps and is coordinating with the FBI to further disrupt the criminal operation.

Accenture Cloud Buckets Exposed Sensitive Credentials

🔓 UpGuard disclosed that Accenture left four Amazon S3 buckets publicly accessible, exposing sensitive Accenture Cloud Platform data including API keys, certificates, plaintext passwords, and private keys. The buckets — labeled acp-deployment, acpcollector, acp-software, and acp-ssl — contained credentials, VPN keys, logs, and large database dumps that included client information. After discovery on September 17, 2017, UpGuard notified Accenture and the buckets were secured the following day. This incident underscores how misconfigured cloud storage can endanger both vendors and their customers.

Cloud Leak Exposes Millions of Dow Jones Customer Records

🔒 A cloud-based file repository owned by Dow Jones & Company was discovered publicly accessible, exposing sensitive subscriber and corporate intelligence data. The repository, an AWS S3 bucket configured to allow any AWS "authenticated user," contained names, addresses, emails, customer IDs and the last four digits of credit cards for millions of accounts. Dow Jones confirmed 2.2 million affected; UpGuard estimated the exposure could encompass up to four million records. The bucket was secured after discovery, but delayed notification reduced victims' ability to mitigate risk.

Alteryx Cloud Leak: 123M U.S. Household Records Exposed

🔓 UpGuard discovered a publicly exposed AWS S3 repository tied to Alteryx that contained a 36 GB ConsumerView dataset from Experian alongside 2010 US Census data. The exposure included over 123 million U.S. household records with detailed demographics, financial indicators, and proprietary segmentation that increased risk of fraud and identity theft. After notification, Alteryx secured the bucket; UpGuard highlights vendor-risk management and continuous monitoring to prevent similar incidents.

Exposure of RNC Voter Data from Deep Root Analytics

🔓 UpGuard’s Cyber Risk Team discovered a publicly accessible Amazon S3 bucket belonging to Deep Root Analytics that contained roughly 1.1 TB of voter-related data tied to an estimated 198 million U.S. voters. The exposed files referenced Republican contractors TargetPoint Consulting and Data Trust and included names, dates of birth, addresses, phone numbers, voter registration details, and billions of modeled attributes used for political microtargeting. After notification and federal involvement, the bucket was secured and public access was removed.

Mass Facebook App Data Exposed in Two Third-Party Leaks

🔓 Two third-party Facebook app datasets were publicly exposed via misconfigured Amazon S3 buckets, including a 146 GB collection from Cultura Colectiva containing over 540 million records of comments, likes, reactions, account names and Facebook IDs. A separate backup from the At the Pool app contained fields such as fb_friends, fb_likes, fb_photos and plaintext passwords for roughly 22,000 users. UpGuard notified the app owners and AWS in January; the larger bucket was not secured until early April after media inquiry. These exposures highlight enduring risks from third-party access to platform data and misconfigured cloud storage.

Exposure of Russian Telecom Infrastructure: MTS and Nokia

🔒 UpGuard secured a 1.7 TB repository that had been publicly accessible via an rsync server, containing schematics, administrative credentials, email archives, photographs, and installation materials tied to Russian telecommunications infrastructure. The dataset appears to primarily implicate Nokia and MTS, and includes detailed documentation for the SORM lawful-intercept system. UpGuard notified vendors and regulators and the files were taken offline after disclosure, though the exposure presented serious national security risks.

Rsync Misconfiguration Exposes Over One Million Leads

🔓 A publicly accessible rsync repository tied to Blue Chair LLC subsidiaries, including Target Direct Marketing and Gragg Advertising, exposed backups and web configuration files containing personally identifiable information for over one million people. The leak included MySQL backups (≈5 GB) with a peg_historical table listing names, addresses, emails, phone numbers and education details. Gragg Advertising moved quickly after notification and secured the service within an hour, but the incident underscores risks from misconfigured rsync services and weak data retention practices.

Exposed rsync Server Leaks Oklahoma Securities Data

🔒UpGuard discovered and secured a publicly accessible rsync server holding roughly three terabytes and millions of files belonging to the Oklahoma Department of Securities. The exposed content included personal records, large email archives, virtual machine images, investigative files, and administrative credentials that threatened the agency’s network integrity. UpGuard notified state personnel and public access was removed on December 8, 2018.