Property management company leaks 30,000 users’ passports, driver’s licenses and other personal data

guest · Jul 17, 2020

New Zealand property management company leaks 30,000 users’ passports, driver’s licenses and other personal data
July 15, 2020
https://cybernews.com/security/new-...mpany-leaks-30000-passports-drivers-licenses/

CyberNews received information from reader Jake Dixon, a security researcher with Vadix Solutions, who discovered an unsecured Amazon Simple Storage Solution (S3) database containing more than 31,000 images of users’ passports, driver’s licenses, evidence of age documents, and more. These files are publicly accessible to anyone who has the URL and appears to be owned by the Wellington, New Zealand company LPM Property Management.

Due to the type of company it is, the unsecured database (which appears to only host image files for the company) also contains pictures of applicants and some property requiring maintenance.
Click to expand...

The way that LPM works is that they will manage various landlords’ property. The images within the database (usually filed under “applicants”) appear to be either landlords or tenants applying for this service.
Nonetheless, these “applicants” images have various documents as proof of identity, most of which are drivers’ licences and some passports.
Click to expand...

What’s the impact?
Having 30,000 passport and driver’s licenses can be a huge find for many bad actors online. This article puts the value of one passport scan at around $14 on the dark web, while another article puts a driver’s license value at about $20. With those prices, the bucket has a price range of $442,540 – $632,200 (assuming the files are either all passports or all driver’s licenses).
Click to expand...

nepeto · Oct 13, 2020

mood said: ↑

New Zealand property management company leaks 30,000 users’ passports, driver’s licenses and other personal data
Click to expand...

Has the origin of the failure in Amazon Simple Storage been known? And if this has already been resolved with a patch? Is there any other similar case known in another country?

Log in or Sign up

Property management company leaks 30,000 users’ passports, driver’s licenses and other personal data

guest Guest

nepeto Registered Member

Log in or Sign up

Property management company leaks 30,000 users’ passports, driver’s licenses and other personal data

guest Guest

nepeto Registered Member

Useful Searches