Software firm leaks 25GB worth of subscription & Ancestry.com user data

guest · Jul 21, 2020

Software firm leaks 25GB worth of subscription & Ancestry.com user data
The data was leaked due to a misconfiguration on an ElasticSearch server
July 21, 2020
https://www.hackread.com/software-firm-leaks-ancestry-com-user-data/

Researchers at cybersecurity firm WizCase discovered a misconfigured cloud server that exposed exclusive customers data of a US-based tech firm that manages the famous Family Tree Maker software, also called FTM.

The research team led by Avishai Efrat claims that the database contained around 25GB worth of data belonging to “The Software MacKiev Company,” which syncs Ancestry.com’s user data, a popular platform for family history search. It is worth noting that previously, Ancestry.com suffered a data breach in which login credentials of 300,000 accounts were leaked in plain-text.

Family Tree Maker, a genealogy software, was released in 1989 and has had many different corporate owners, including The Learning Company, Broderbund, and Mattel, before Ancestry.com.
Click to expand...

As for the latest incident, according to researchers, approximately 60,000 MacKiev users are reportedly affected by the data exposure after a misconfigured ElasticSearch server was left open for public access.
Moreover, the leaked data also included user complaints, which could have been useful for the US tech firm’s competitors as they would have easily targeted unhappy clients.
Click to expand...

WizCase: Family History Search Software Leaks Users’ Private Data

guest · Aug 2, 2020

Ancestry.com claims no harm from security vulnerability in Family Tree Maker
August 1, 2020
https://betanews.com/2020/08/01/ancesty-security/

Unfortunately, independent review site WizCase recently discovered an open and unencrypted ElasticSearch server that belonged to Software MacKiev, the owners of Family Tree Maker.
The leak exposed thousands of records including email addresses, user locations, and other sensitive personal information.

Writing about the issue, Ancestry has been quick to reassure its own customers stating:

"We have been alerted to a potential security vulnerability at the MacKiev Company, which owns Family Tree Maker software. While we no longer have formal affiliation with the company, Family Tree Maker is used by some Ancestry customers to sync family trees between Family Tree Maker software and Ancestry."
The company goes on to state that after an investigation, it does not believe any of its systems or data has been compromised. Its protocol for FTM to access its database uses OAuth2 to authenticate.
Click to expand...

However, just to be safe, the company states "As a best practice, we recommend Ancestry customers who have used their Ancestry credentials to access Family Tree Maker software change their password and enable two-factor authentication."
Click to expand...

mood said: ↑

WizCase: Family History Search Software Leaks Users’ Private Data
Click to expand...

Updated (July 30, 2020):

Editor’s Note: Following Ancestry’s reach out, we wanted to clarify some points —

The Family Tree Maker may utilize data users had downloaded from their Ancestry accounts, however, there is no current affiliation or “link” between the Ancestry and MacKiev companies.

There was no evidence of a breach to Ancestry’s own system.

Click to expand...

Log in or Sign up

Software firm leaks 25GB worth of subscription & Ancestry.com user data

guest Guest

guest Guest

Log in or Sign up

Software firm leaks 25GB worth of subscription & Ancestry.com user data

guest Guest

guest Guest

Useful Searches