FlexBooker Data Leak Impacts Millions of End Customers

An on-line reserving program supplier unwittingly leaked the information of thousands and thousands of customers on the web following misconfiguring a cloud storage remedy, in accordance to scientists.

A group at comparison website vpnMentor located the leak on January 23 and traced it back to US business FlexBooker, which presents program that permits organizations to acknowledge bookings on their web-sites.

The 172GB trove was left completely unsecured owing to a misconfigured Amazon Web Solutions (AWS) S3 bucket. It was fastened a few times later on immediately after the scientists attained out to both of those the seller and AWS.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“FlexBooker’s misconfigured AWS account contained around 19 million HTML data files which exposed what appeared to be automatic e-mail despatched by means of FlexBooker’s system to buyers. This implies perhaps up to 19 million people today had been exposed, relying on how several individuals manufactured multiple bookings on a web-site making use of FlexBooker,” vpnMentor stated.

“Each email appeared to be a confirmation message for bookings produced by means of the system and uncovered both equally the FlexBooker account holder and the person(s) who produced a reserving.”

Between the details considered by the team incorporated full names, email addresses, phone quantities and appointment particulars.

Just about every uncovered email contained a website link with a one of a kind code that could be employed to create cancellation backlinks, edit backlinks and perspective appointment aspects, the report included. Details on some children was also uncovered by using a FlexBooker shopper which was a babysitting service.

If hackers managed to access the leaked facts, they could have made use of it to craft adhere to-on phishing and identity theft attacks by posing as the businesses with which finish-consumers built bookings.

The discovery came just days right after FlexBooker was forced to admit a December knowledge breach that purportedly compromised just about 4 million customer accounts.

“On December 23, 2021, setting up at 4:05 PM EST our account on Amazon’s AWS servers was compromised, resulting in our short term incapability to assistance consumer accounts, and stopping customers from accessing their info,” it stated at the time.

“As aspect of the incident, our technique details storage was also accessed and downloaded. In reaction to the outage, we labored carefully with Amazon to restore a backup, and ended up equipped to restore functions within just 12 hrs.”

It’s unclear whether or not this incident also stemmed from a misconfigured server or if the attackers compromised FlexBooker’s cloud infrastructure in different ways.