Millions of Oklahoma Gov Files Exposed by Wide-Open Server

guest · Jan 16, 2019

Millions of Oklahoma Gov Files Exposed by Wide-Open Server
January 16, 2019
https://threatpost.com/oklahoma-gov-data-leak/140936/

Millions of sensitive files on a storage server belonging to the Oklahoma Department of Securities were left exposed for a week – including credentials, internal docs and personal data stretching back decades.
“The amount, and reach, of administrative and staff credentials represents a significant impact to the Oklahoma Department of Securities’ network integrity,” said UpGuard in a Wednesday post detailing the leak.

The data was exposed through an unsecured rsync service, which is is a utility for synchronizing files across computer systems. It resided at an IP address registered to the Oklahoma Office of Management and Enterprise Services, researchers said. That allowed any user from any IP address to download all the files stored on the server.

“Sensitive data is often shared in vulnerable places, so Oklahoma’s potential breach of 3TB of FBI data isn’t especially shocking,” Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, said in an email.
Researchers stressed the importance of maintaining control over data storage.
Click to expand...

mirimir · Jan 17, 2019

“Sensitive data is often shared in vulnerable places, so Oklahoma’s potential breach of 3TB of FBI data isn’t especially shocking,” Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, said in an email.
Click to expand...

Maybe "shocking" isn't such a great choice of wording. It's certainly not surprising, but shocking it is, still.

guest · Feb 21, 2019

Oklahoma Securities Commission’s Data Availed in the Wild
February 20, 2019
https://securityboulevard.com/2019/02/oklahoma-securities-commissions-data-availed-in-the-wild/

The access achieved by UpGuard revealed basic cyber-hygiene issues within the OSC.

Think about that: Three terabytes of FBI data left on an unsecured server, not even password-protected.
Cybersecurity 101 calls for the protection of sensitive data.

The question that needs to be asked and asked again and again is, How often is the environment where sensitive data is placed tested to ensure it is secure? Is data security being taken seriously?
Perhaps a better rule of thumb and strategy would be to follow the age-old adage, “Don’t collect what you won’t protect.”
Click to expand...

guest · Mar 13, 2020

Oklahoma Accused of Negligence in Massive Data Breach
A December 2018 data breach in the Oklahoma Department of Securities allegedly released names, Social Security numbers
March 13, 2020
https://www.governing.com/security/Oklahoma-Accused-of-Negligence-in-Massive-Data-Breach.html

A class-action lawsuit has been filed against the Oklahoma Department of Securities over a massive December 2018 data breach that allegedly caused the names, Social Security numbers and other personal information of more than 300,000 people to be published to the internet.

The department caused the data breach by negligently misconfiguring a new firewall that it was installing with the aid of a consultant, the lawsuit alleges.
The lawsuit also alleges that the department waited several weeks to notify law enforcement about the data breach, which resulted in valuable evidence being lost.

"Only after news reporters began asking questions and public exposure became inevitable did the department notify law enforcement and begin investigating the data breach," the lawsuit states.
Larson and Mims said the department took about five months to notify them of the data breach, which increased their risk of becoming victims of identity theft.
Click to expand...

Log in or Sign up

Millions of Oklahoma Gov Files Exposed by Wide-Open Server

guest Guest

mirimir Registered Member

guest Guest

guest Guest

Log in or Sign up

Millions of Oklahoma Gov Files Exposed by Wide-Open Server

guest Guest

mirimir Registered Member

guest Guest

guest Guest

Useful Searches