Two cashback sites leaked data of 3.5 million users

guest · Oct 16, 2019

Two cashback sites leaked data of 3.5 million users
October 16, 2019
https://z6mag.com/2019/10/16/two-cashback-sites-leaked-data-of-3-5-million-users/

Two popular cashback services have leaked nearly two terabytes worth of personally identifiable information (PII) and account data in an unprotected Elastic database. The two cashback websites have been operating mostly in the United Kingdom and India.

The two sister sites are operating in the U.K. and India, and are both owned by Pouring Pounds Ltd. The leak has affected approximately 3.5 million individuals.

“The elastic server was publicly exposed without any password protection. Searching at a specific port, anyone could find it easily and take advantage of it maliciously. From what we can see, it was exposed since August 9, 2019,” the disclosure blog post from Security Detectives read.
According to the Head of the team, Anurag Sen, he and his colleagues have found that cashback and voucher websites Cashkaro.com and Pouringpounds.com have both made available key details about their active users.

Pouringpounds.com, which has over a million users, has exposed account details such as username and passwords of its users, putting them in a vulnerable position where they can be targeted by a credential stuffing attack.
Meanwhile, similar information was also disclosed in the database containing the data of 2.5 million registered users of Cashkaro.com.
Click to expand...

Safety Detectives: Cashback Sites Leak Unencrypted Passwords, Bank & Other Sensitive User Data

guest · Oct 17, 2019

CashKaro Refutes Reports Of Breach Of Personal Data Of 3.5 Mn Individuals
October 17, 2019
https://inc42.com/buzz/cashkaro-ref...reach-of-personal-data-of-3-5-mn-individuals/

In what could be a huge data and security breach for Indian shoppers, a security research team at Safety Detectives has alleged that Cashkaro and its UK-based parent company Pouringpounds has compromised data of up to 3.5 Mn individuals.

On reaching out, CashKaro cofounder, Swati Bhargava, told Inc42, “We vehemently deny the inaccurate claims made in the blog post. We have repeatedly tried to contact Safety Detectives since the blog post was published and have requested to take the inaccurate blog post down, but have not received any revert from them. Maintaining the confidentiality of our customers is of utmost importance to us and we are deeply committed to protecting the same.”

Multiple security researchers Inc42 talked to said that since servers are now offline, it can’t be confirmed if the leak happened but the details seem genuine. They said that the breach happened because of an elastic search instance which is open to the public without any authentication.
Click to expand...

Log in or Sign up

Two cashback sites leaked data of 3.5 million users

guest Guest

guest Guest

Log in or Sign up

Two cashback sites leaked data of 3.5 million users

guest Guest

guest Guest

Useful Searches