Marketing Firm Exposed 49 Million Unique Emails Due to Mishandled Credentials

guest · Feb 28, 2020

49 Million Unique Emails Exposed Due to Mishandled Credentials
February 28, 2020
https://www.bleepingcomputer.com/ne...emails-exposed-due-to-mishandled-credentials/

An Israeli marketing firm exposed 49 million unique email addresses after mishandling authentication credentials for an Elasticsearch database, that were sitting in plain text on an unprotected web server.
In a vaguely-worded notification this week, Straffic, a privately-held digital marketing company, informed that the incident was the result of a "security vulnerability" affecting one of its servers.
Unexpected vulnerability
Straffic is described as "a private network for connecting elite affiliates with CPA [cost per action] & CPL [cost per lead] offers from trusted advertisers."

In a short message on Wednesday, the company announced that "a security vulnerability has been found on one of the servers we use to provide our services."
The asset was an Elasticsearch database with 140GB of contact details consisting of names, phone numbers, and postal addresses. While it was password protected, it appears that the credentials were not properly stored.
Click to expand...

Hunt, who is very familiar with disclosure notices, points out that Straffic's announcement lacks the basic information that should be available in such a communication. Details about the the date of the incident (or at least an estimation), what caused it, how it was addressed, and informing impacted parties are missing.
Click to expand...

Log in or Sign up

Marketing Firm Exposed 49 Million Unique Emails Due to Mishandled Credentials

guest Guest

Log in or Sign up

Marketing Firm Exposed 49 Million Unique Emails Due to Mishandled Credentials

guest Guest

Useful Searches