All news with #data breach tag

🔓 UpGuard’s Cyber Risk Team discovered a publicly accessible AWS S3 repository tied to Election Systems & Software (ES&S) that contained multiple backups and a 12 GB MSSQL database. The data set included about 1.864 million Chicago voter records with names, addresses, dates of birth, phone numbers, driver’s license numbers and partial Social Security numbers. The bucket, labeled “chicagodb,” was found on August 11, 2017; ES&S was notified and the exposure was secured by August 12, 2017. This incident highlights vendor misconfiguration risk and the need for rigorous vendor risk management and configuration checks.

🔓 This UpGuard report describes a publicly accessible Amazon S3 data warehouse owned by Deep Root Analytics that contained 1.1 TB of unsecured files and linked datasets from Data Trust and TargetPoint. The exposed records included personally identifiable information for up to 198 million US voters alongside modeled political attributes and scoring. UpGuard discovered the bucket on June 12, 2017; Deep Root secured it after notification, and the report details discovery, contents, and implications for election data privacy.

🔓 UpGuard's Data Breach Research team discovered and secured a publicly accessible rsync storage server containing data belonging to the Oklahoma Department of Securities. The exposure included approximately 3 TB and millions of files spanning 1986–2016, including email archives, virtual machine images, system credentials, and personal records. UpGuard identified the host via Shodan, notified state officials, and public access was removed the same day.

🔓 UpGuard's Cyber Risk Team discovered an exposed rsync repository tied to subsidiaries of Blue Chair LLC, including Target Direct Marketing, that revealed PII for over one million individuals seeking higher education information. The publicly accessible server included daily MySQL backups and website files, with names, emails, phone numbers and education-related lead fields. The exposure resulted from an rsync misconfiguration and highlights the need for strong vendor risk controls, data retention policies and restricted backup access.

🔒 An UpGuard researcher discovered three publicly accessible Amazon S3 buckets tied to Attunity, a data integration vendor now part of Qlik. One bucket contained a sampled terabyte of backups, including roughly 750 GB of compressed email archives and OneDrive backups with system credentials, project documents, client lists, and employee PII. The researcher notified the vendor on May 16, 2019, and public access was removed the following day. The incident highlights how backup misconfigurations can expose credentials and sensitive corporate and customer data.

⚠️ The UpGuard Cyber Risk Team discovered a publicly accessible rsync repository belonging to Texas-based Power Quality Engineering (PQE) that exposed sensitive electrical infrastructure data for clients including Dell, Oracle, and Texas Instruments. Up to 205 GB of reports, schematics, infrared imagery and a plaintext file of internal passwords were downloadable. The exposure, discovered on July 6, 2017 and remediated after notification, illustrates vendor risk and misconfigured services. Recommended mitigations included restricting rsync access, enforcing authentication and network ACLs, and implementing continuous vendor monitoring.

🔍 UpGuard discovered three publicly accessible Amazon S3 buckets associated with CENTCOM and PACOM that contained a vast corpus of scraped internet posts. One bucket alone held an estimated 1.8 billion records spanning 2009–2017, including news articles, forum threads, comment sections and social media posts. Configuration files and folders referenced a contractor, VendorX, and projects named Outpost and Coral, while Lucene indexes indicated the data was organized for search. UpGuard notified the Defense Department and the buckets were secured.

🔒 UpGuard discovered and secured a 1.7 TB publicly accessible storage repository that contained detailed documentation of telecommunications infrastructure across Russia, including schematics, administrative credentials, email archives and photographs. The dataset, hosted on an rsync server, appears to relate primarily to projects by Nokia and carrier MTS. Files included installation instructions and images for SORM interception hardware, raising significant operational and national-security risks. UpGuard notified Nokia and access was closed within days.

🔒 UpGuard discovered an Amazon S3 bucket at the subdomain 'alteryxdownload' that was misconfigured to allow any AWS 'Authenticated Users' to download its contents. The repository included Alteryx software and a 36 GB ConsumerView dataset from Experian containing 123 million household records and 248 fields. A separate file held public 2010 US Census data. Alteryx secured the bucket after notification, underscoring vendor and cloud configuration risk.

🔒Two exposed third-party Facebook app datasets were discovered publicly accessible, including a 146 GB dump from Cultura Colectiva containing over 540 million records of comments, likes, reactions, account names and Facebook IDs. A separate At the Pool backup held profile fields and plaintext passwords for roughly 22,000 users. Both data sets resided in publicly readable Amazon S3 buckets, illustrating how misconfigured storage and long-lived third-party copies of user data create persistent leakage risk.

🔒 A cloud-based file repository owned by Dow Jones & Company was discovered publicly accessible, exposing sensitive personal and financial details for millions of customers. UpGuard researcher Chris Vickery located an AWS S3 bucket under the subdomain dj-skynet on May 30, 2017; Dow Jones secured the repository on June 6 after notification. Exposed material included names, addresses, account identifiers, login emails, the last four digits of credit cards, and 1.6 million entries tied to Dow Jones Risk and Compliance products, illustrating the dangers of cloud misconfiguration.

🔒 UpGuard discovered three publicly accessible AWS S3 buckets—centcom-backup, centcom-archive, and pacom-archive—containing years of scraped internet content. The stores included at least 1.8 billion posts, Lucene search indexes, and developer configuration referencing VendorX, Outpost, and Coral. UpGuard notified the Defense Department, and access was subsequently secured.

🔓 A publicly accessible rsync repository tied to Blue Chair LLC subsidiaries, including Target Direct Marketing and Gragg Advertising, exposed backups and web configuration files containing personally identifiable information for over one million people. The leak included MySQL backups (≈5 GB) with a peg_historical table listing names, addresses, emails, phone numbers and education details. Gragg Advertising moved quickly after notification and secured the service within an hour, but the incident underscores risks from misconfigured rsync services and weak data retention practices.

🔒 UpGuard secured a 1.7 TB repository that had been publicly accessible via an rsync server, containing schematics, administrative credentials, email archives, photographs, and installation materials tied to Russian telecommunications infrastructure. The dataset appears to primarily implicate Nokia and MTS, and includes detailed documentation for the SORM lawful-intercept system. UpGuard notified vendors and regulators and the files were taken offline after disclosure, though the exposure presented serious national security risks.

🔓 Two third-party Facebook app datasets were publicly exposed via misconfigured Amazon S3 buckets, including a 146 GB collection from Cultura Colectiva containing over 540 million records of comments, likes, reactions, account names and Facebook IDs. A separate backup from the At the Pool app contained fields such as fb_friends, fb_likes, fb_photos and plaintext passwords for roughly 22,000 users. UpGuard notified the app owners and AWS in January; the larger bucket was not secured until early April after media inquiry. These exposures highlight enduring risks from third-party access to platform data and misconfigured cloud storage.

🔓 UpGuard’s Cyber Risk Team discovered a publicly accessible Amazon S3 bucket belonging to Deep Root Analytics that contained roughly 1.1 TB of voter-related data tied to an estimated 198 million U.S. voters. The exposed files referenced Republican contractors TargetPoint Consulting and Data Trust and included names, dates of birth, addresses, phone numbers, voter registration details, and billions of modeled attributes used for political microtargeting. After notification and federal involvement, the bucket was secured and public access was removed.

🔓 UpGuard discovered a publicly exposed AWS S3 repository tied to Alteryx that contained a 36 GB ConsumerView dataset from Experian alongside 2010 US Census data. The exposure included over 123 million U.S. household records with detailed demographics, financial indicators, and proprietary segmentation that increased risk of fraud and identity theft. After notification, Alteryx secured the bucket; UpGuard highlights vendor-risk management and continuous monitoring to prevent similar incidents.

🔒 A cloud-based file repository owned by Dow Jones & Company was discovered publicly accessible, exposing sensitive subscriber and corporate intelligence data. The repository, an AWS S3 bucket configured to allow any AWS "authenticated user," contained names, addresses, emails, customer IDs and the last four digits of credit cards for millions of accounts. Dow Jones confirmed 2.2 million affected; UpGuard estimated the exposure could encompass up to four million records. The bucket was secured after discovery, but delayed notification reduced victims' ability to mitigate risk.

🔓 UpGuard disclosed that Accenture left four Amazon S3 buckets publicly accessible, exposing sensitive Accenture Cloud Platform data including API keys, certificates, plaintext passwords, and private keys. The buckets — labeled acp-deployment, acpcollector, acp-software, and acp-ssl — contained credentials, VPN keys, logs, and large database dumps that included client information. After discovery on September 17, 2017, UpGuard notified Accenture and the buckets were secured the following day. This incident underscores how misconfigured cloud storage can endanger both vendors and their customers.

🔒 An UpGuard researcher discovered three publicly accessible Amazon S3 buckets tied to Attunity (now part of Qlik) that contained a large collection of internal business documents and backups. The researcher sampled roughly one terabyte of data, including about 750 GB of compressed email backups, plus OneDrive backups, system credentials, private keys, and employee records. UpGuard notified the vendor on May 16, 2019, and public access to the buckets was removed the following day.