Another major data breach has left roughly 340 million records exposed by data aggregation firm Exactis after information was left on a publicly accessible server. The 2 terabytes' worth of data appears to include the personal details of the individuals listed, including phone numbers, home addresses, email addresses and other highly personal characteristics for every name.
The type of personal information that was potentially compromised should be concerning to consumers, given the enormous volume of information that is collected, spliced together and housed in databases such as the one that was leaked by Exactis, said Anurag Kahol, Bitglass CTO.
“Exposing that amount of data to the public internet is a significant offense by the organization and one that we’ve seen dozens of times in the past year, yet it is unlikely that we’ll see anything change unless organizations take the initiative in protecting corporate data,” Kahol said.
News of the breach raises questions about whether Exactis knew what type of information it had and whether it considered the potential implications if that information were compromised. “The problem with most enterprises today,” said Ruchika Mishra, Balbix director of products and solutions, “is that they don’t have the foresight and visibility into the hundreds of attack vectors – be it misconfigurations, employees at risk of being phished, admin using credentials across personal and business accounts – that could be exploited.”
It could be months before the real impact of the breach can be measured, but what has initially been reported is alarming and there would not be any surprise if Exactis confirmed that 340 million individuals were indeed impacted.
“The Exactis data leak should enrage consumers and businesses alike. The sheer amount of cloud databases left accessible on the Internet is astounding, especially when one considers the type and amount of data that users store on it without giving it second thought,” said John “Lex” Robinson, cybersecurity strategist at Cofense.
“It is worth noting that just because the server was left open to the public does not mean it was stolen by malicious hackers, but we cannot be certain. The data reported to have been leaked is incredibly comprehensive and can be used by hackers to develop more targeted phishing scams.”