Office Depot Configuration Error Exposes One Million Records

A misconfigured Elasticsearch server belonging to a popular business supplies keep chain was found leaking just about 1 million records which includes customers’ own information and facts, it has emerged.

The non-password safeguarded database was found by a Site Earth crew led by Jeremiah Fowler on March 3. They swiftly traced it again to Business Depot Europe, which operates across the area with bricks-and-mortar shops and on line beneath the Workplace Depot and Viking models.

Among the the 974,000 unencrypted documents identified in the databases ended up purchaser names, phone numbers, residence and workplace addresses, @associates.ebay addresses, marketplace logs, get histories and hashed passwords.

Fowler warned that such knowledge could have been applied by cyber-criminals to perform convincing phishing attacks.

“Let’s hypothetically say a legal phone calls the consumer and they validate the current purchase. Future the criminal says a little something is improper with your billing information, can you make sure you offer me with the credit history card variety utilised for your obtain?” he described.

“The shopper would have no rationale to doubt this for the reason that the caller can validate real aspects that only the retailer would know. This is how a social engineering attack operates and it is one of the most frequent kinds of fraud utilized these days.”

Though Office Depot Europe secured the databases inside of hrs of notification, thanking the researchers for bringing it to their interest, Fowler claimed it may well have been uncovered for up to 10 times.

This would have set it at risk not only from info-hunting fraudsters but automated ransomware scripts and other resources which scour the internet for misconfigured databases like this.

Together with the customer info was information on middleware, IP addresses, ports, pathways and storage programs utilised by the corporation which Fowler said could have been exploited to goal the Office environment Depot company network.

Some pieces of this article are sourced from:
www.infosecurity-journal.com