CVS Health data breach leaves a billion records exposed

A misconfiguration in a CVS Health cloud databases still left above a billion data exposed, in accordance to an investigation by WebsitePlanet in cooperation with security researcher Jeremiah Fowler. 

The about 240GB databases was not password protected, meaning anyone who understood where by to look could obtain the information held within.

A full of 1,148,327,940 information belonging to the US well being care and pharmaceutical behemoth, which owns CVS Pharmacy and Aetna, were being located. The database contained generation records that exposed Visitor ID, Session ID, and machine details (i.e., iPhone, Android, iPad, and many others.). 

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Worryingly, the data files also gave threat actors a very clear comprehending of configuration settings, where by info is stored, and a blueprint of how the logging service operates from the backend.

Scientists also found various records of visitors’ lookup histories, which include drugs, COVID-19 vaccines, and other CVS goods.

“Hypothetically, it could have been possible to match the Session ID with what they searched for or extra to the searching cart for the duration of that session and then test to discover the purchaser working with the uncovered emails,” scientists reported.

The investigation also carried out a sampling research question that disclosed e-mail hackers could concentrate on in a phishing attack or likely use to cross-reference other steps.

Just after identifying the unprotected database on March 21, the researchers immediately despatched a responsible disclosure discover to CVS Health and fitness. The firm limited community accessibility the same day.

In a statement, CVS Wellbeing stated, “We had been able to access out to our vendor and they took rapid motion to clear away the databases. Defending the personal information and facts of our consumers and our company is a large priority, and it is essential to notice that the databases did not contain any own facts of our shoppers, members or individuals.”

Paul Norris, a senior units engineer at Tripwire, instructed ITPro that misconfigurations like these are starting to be all way too popular. 

“Exposing sensitive information doesn’t involve a subtle vulnerability, and the fast progress of cloud-based mostly info storage has uncovered weaknesses in procedures that depart facts offered to anybody. A misconfigured databases on an internal network may not be discovered, and if observed may well not go community, but the stakes are bigger when your info storage is instantly connected to the Internet,” he explained.

“Organizations really should determine procedures for securely configuring all methods, together with cloud-primarily based storage, like Elasticsearch and Amazon S3. When a method is in put, the units have to be monitored for alterations to their configurations. These are solvable problems, and tools exist nowadays to aid.”