Thousands of customer records exposed after serious data breach
Business app developer fails to follow basic security practises for Microsoft Azure blob storage
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Thanks to questionable security practises by an app developer, more than half a million sensitive documents of its customers were exposed on the Internet. The documents were housed in an unprotectedMicrosoft Azureblob storage and could be viewed by anyone with the direct address of the files, without any kind of authentication.
Azure Blob storage is a feature ofMicrosoftAzure that allows users to store large amounts of unstructured data on Microsoft’s data storage platform.
The unsecured blob was managed by Surrey-based app developer Probase and according toThe Register, it contained 587,000 files, ranging from backed-up emails to letters, spreadsheets, screenshots, and more.
Questionable security practises
The Registercaught wind of the unsecured blob thanks to security researcher Oliver Hough who was spooked by the lack of security controls on it.
“Finding a storage bucket like this where a provider has lumped all of their clients' files in a single bucket rather than creating separate storage for each client demonstrates how, in 2020, the basics of secure design are still not being followed,” Hough toldThe Register.
The blob contained occupational health assessments, insurance claim documents from US firms underwritten by Lloyds of London, and senior barristers' private opinions about junior colleagues applying for promotion.
More worryingly however the blob also included FedEx shipment security documentation, along with highly sensitive medical data, and at least one passport scan.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
When approached, Probase director Paul Brown, did not comment on how long the blob had been left unsecured, but shared that they are working closely with the Information Commissioner’s Office to resolve the issue.
This is just one of the latest instances of data leaks through Microsoft’s Azure blob storage. While the burden of this exposure lies primarily with Probase, there’s also the fact that Microsoft Azure allows careless developers to create such unsecured data silos.
Via:The Register
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Another reason to avoid edge-lit 4K TVs: they may fail faster than others, according to this report
