A Billion CVS Records Exposed

More than a billion information ended up uncovered after a misconfiguration mistake still left a CVS Health cloud database with no password safety.

The 240GB of unsecured data was discovered by WebsitePlanet and security researcher Jeremiah Fowler in a cooperative investigation. 

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Simply because of the security oversight by CVS Overall health, which owns CVS Pharmacy and Aetna, a complete of 1,148,327,940 information have been exposed.

Details that was left publicly obtainable to any person who realized how to search for it provided customers’ research histories detailing their medicines, and output records that exposed visitor ID, session ID, and system details (i.e., iPhone, Android, iPad, etc.). 

Own knowledge was also uncovered, with scientists noting that “a sampling lookup question uncovered e-mail that could be targeted in a phishing attack for social engineering or possibly utilized to cross reference other actions.”

Researchers reported that any danger actors who accessed the databases could have gleaned a very clear comprehension of configuration options, discovered where details is stored, and accessed a blueprint of how the logging support operates from the backend.

Right after encountering the unprotected database on March 21, researchers contacted CVS Wellness, which acted quickly to limit community accessibility.

“We were in a position to get to out to our seller and they took quick motion to clear away the databases,” claimed CVS Wellbeing. “Guarding the private facts of our buyers and our business is a significant priority, and it is vital to observe that the database did not comprise any individual facts of our shoppers, users or clients.”

“Misconfigurations like these are getting to be all far too frequent. Exposing sensitive details doesn’t have to have a sophisticated vulnerability, and the fast expansion of cloud-centered info storage has exposed weaknesses in procedures that depart information accessible to anybody,” PJ Norris, senior techniques engineer at Tripwire, told Infosecurity Magazine.

He continued: “A misconfigured database on an internal network could not be found, and if discovered, could not go public, but the stakes are bigger when your facts storage is immediately related to the internet. Businesses need to identify procedures for securely configuring all methods, which include cloud-based mostly storage, like Elasticsearch and Amazon S3.”