Data on almost every Ecuadorean citizen leaked

guest · Sep 16, 2019

Data on almost every Ecuadorean citizen leaked
September 16, 2019
https://www.bbc.co.uk/news/technology-49715478

Names, financial information and civil data about 17 million people, including 6.7 million children, was found by security company vpnMentor.

The massive cache of data was found on an unsecured Amazon cloud server almost anyone could look at.
Access to the server has now been restricted thanks to Ecuador's computer emergency security team.
Serious breach
"The data breach involves a large amount of sensitive personally identifiable information at the individual level," wrote Noam Rotem and Ran Locar, from vpnMentor.

The cache of information also included some financial records tallying account balances of customers of one large Ecuadorean bank. Tax records, including official revenue ID numbers for companies, were found on another file.
Click to expand...

ronjor · Sep 17, 2019

Arrest made in Ecuador's massive data breach

By Catalin Cimpanu for Zero Day September 17, 2019
Ecuador police arrest director of data analytics firm that leaked the personal records of most of Ecuador's population.
Click to expand...

guest · Sep 18, 2019

Industry Reactions to Massive Ecuador Data Leak
September 17, 2019
https://www.securityweek.com/industry-reactions-massive-ecuador-data-leak

The exposed Elasticsearch database was roughly 18 GB in size and it stored information on 20 million individuals — Ecuador has a population of approximately 16 million.
Industry professionals have commented on the incident and shared recommendations on how such leaks can be avoided.

“While cloud computing’s instant provisioning and scale are valuable benefits, cloud administrators must know what they’re doing and ensure appropriate access controls are in place to protect their data.
[...] The bigger question I have is why is that level of personal data from a government given to a marketing analytics company? What purpose does it serve?

[...] Among other repercussions, this kind of data is more than enough for cybercriminals to orchestrate sophisticated Business Email Compromise (BEC) scams, in which a cybercriminal impersonates the identity of a trusted business partner or coworker in order to launch convincing spear phishing attacks targeting companies for monetary gain. [...]
Following best practices such as network segmentation and the 'least privilege' model helps prevent these kinds of leaks from occurring. [...] Surprisingly, these heavily recommended practices are not followed commonly.
Click to expand...

Log in or Sign up

Data on almost every Ecuadorean citizen leaked

guest Guest

ronjor Global Moderator

guest Guest

Log in or Sign up

Data on almost every Ecuadorean citizen leaked

guest Guest

ronjor Global Moderator

guest Guest

Useful Searches