VAT software supplier exposed data of millions

guest · Mar 10, 2020

VAT software supplier exposed data of millions
Eight million sales records belonging to UK and EU consumers left exposed due to misconfigured server
March 10, 2020
https://www.computerweekly.com/news/252479784/VAT-software-supplier-exposed-data-of-millions

A MongoDB database containing the personal data of millions of UK residents was left exposed to the public internet for almost a week after its owner neglected to secure the Amazon Web Services (AWS) server that housed it.

The company in question, an unnamed software supplier, pulled records including names, email addresses, shipping addresses, purchase details, and redacted credit card numbers from the marketplace and payment system application programming interfaces (APIs) of Amazon, Ebay, PayPal, Shopify and Stripe to help merchants using these platforms calculate VAT.

It also contained Amazon Marketplace Web Services (MWS) queries including authentication tokens, API queries, AWS access key IDs and secret keys.
Click to expand...

However, according to Comparitech threat researcher Bob Diachenko, who uncovered the exposed server on 3 February, the owner left the records visible to the web without any password or authentication needed to access it.

“Time was of the essence here, since millions of UK shoppers personal, payment and shipment information was at risk, so I started to analyse the content of database and after several days I made the connection to the ultimate owner,” said Diachenko.
Blame game
Comparitech said this latest exposure exemplified how easily and frequently personal and payment details often pass through the hands of various other organisations contracted to process, organise and analyse it.
Click to expand...

Comparitech: 8 million UK shopping records exposed on the web, customers’ personal info leaked

Log in or Sign up

VAT software supplier exposed data of millions

guest Guest

Log in or Sign up

VAT software supplier exposed data of millions

guest Guest

Useful Searches