‘Reindeer’, a New York-based digital media advertising and marketing company that is now out of business, has left an Amazon S3 bucket exposed to public access resulting in the irreversible leak of 50,000 files that account to a total of 32 GB of size.
Information exposed included about 1,400 profile photos and the details of approximately 306,000 customers in total. Personal details include name, surname, email address, date of birth, physical address, hashed passwords, and Facebook IDs. Phone numbers and physical addresses were the rarest information compromised, but nearly 100,000 of each were exposed. A total of 35 countries were included in the user count with the top 3 (the US, Canada, and Great Britain) accounting for almost 280,000 of those users.
Experts weighed-in on this incident.
Pravin Rasiah, VP of Product, CloudSphere:
“Improperly secured AWS S3 buckets are notorious for being one of the leading causes of data breaches due to misconfiguration. This is because inexperienced users can accidentally select the “all users” access option, unwittingly making the bucket publicly accessible. Unfortunately, the chances of this are all too high, leaving many unsuspecting companies leveraging S3 buckets prime targets for hackers looking to exploit sensitive data. To combat this risk, businesses must be acutely aware of any abnormalities within the cloud environment. Leveraging a cloud governance platform with holistic, real-time visibility into the cloud landscape can enable businesses to remediate issues before hackers can target them, ensuring customer data stays secure.”
Tyler Shields, CMO at JupiterOne:
Misconfigurations and errors in deployment have been exacerbated by the race to move technology to the cloud and a lack of visibility and consistent security within cloud native deployments. Unfortunately, it's very easy to make configuration and permissions / access errors within cloud native deployments. Moving forward, enterprises moving to the cloud would do well to have some system in place that tracks cyber asset state and alerts on errors for their entire cloud infrastructure.
Mohit Tiwari, Co-Founder and CEO at Symmetry Systems: