Massive data leak could affect nearly all American adults, security researcher says
Massive data leak could affect nearly all American
adults, security researcher says
By LEVI SUMAGAYSAY PUBLISHED: June 28, 2018 at 8:23 am
A new data leak could affect hundreds of millions of
Americans, perhaps more than the nearly 150 million affected by the Equifax
breach.
Exactis, a Florida-based marketing and data-aggregation
firm, leaked detailed information on individual adults and businesses, a
security researcher says. While the exact number of individuals affected isn’t
known, the leak involved about 340 million records on a publicly available
server.
Wired was the first to report that the exposed
information included phone numbers, home addresses, email addresses and
personal characteristics for every name, such as interests and habits, plus the
number, age and gender of the person’s children. Other types of information
found: religion, whether a person smokes, type of pet.
On the website of Exactis — which was inaccessible as of
Thursday morning — it claims to have data on 218 million individuals, including
110 million U.S. households, and 3.5 billion “consumer, business, and digital
records.”
Vinny Troia, the security researcher who discovered the
leak and reported it to Exactis — which he said he since protected the data —
told this publication Thursday that he looked for about 40 or 50 names and
“everybody he searched for came up. I searched celebrities, I searched people I
know.”
“It seems like this is a database with pretty much every
U.S. citizen in it,” Troia, who’s also founder of New York-based security
company Night Lion Security, told Wired, which also asked Troia to look up
names in the database and confirmed the authenticity of some of the
information, although some of it was outdated. “I don’t know where the data is
coming from, but it’s one of the most comprehensive collections I’ve ever
seen.”
Troia told Wired he was curious about the security of
ElasticSearch, which the magazine described as “a popular type of database
that’s designed to be easily queried over the internet using just the command
line.” When he did a search on the database, he found the Exactis database,
which was unprotected. He said he also told the FBI about his findings.
If the Exactis numbers are accurate, this leak would make
it one of the biggest data security breaches in a while, topping last year’s
Equifax breach and the number of Facebook users affected by the Cambridge
Analytica privacy scandal, which according to Facebook was up to 87 million.
The information leaked by Exactis did not include Social
Security numbers like the Equifax breach did. But it did include some general
financial information, Troia said Thursday.
“When I looked myself up, I found the name of my mortgage
lender, the value class of my home and whether or not I had certain kind of
credit card,” Troia said.
Marc Rotenberg, executive director of the nonprofit
Electronic Privacy Information Center, told Wired that the information leaked
from Exactis could be used to impersonate others.
Exactis has not yet returned a request for comment. The
company’s clients include companies in the media, financial services and
e-commerce industries, according to Crunchbase.
Comments
Post a Comment