Dow Jones & Company has accidentally leaked the personal details and financial information of at least 2.2 million of its customers, but security experts believe this number is said to increase.

Security researchers at UpGuard found that a cloud-based file repository had been misconfigured to allow semi-public access to 2.2 million customers, however, UpGuard believes the number may be as high as 4 million.

The leak was revealed on May 30 and the database was secured by June 6, however, Dow Jones made little to no effort to notify customers of the incident, aside from an article published in the Journal on July 16 covering the leak. It’s of utmost importance that any organization who experiences a breach notifies their customers immediately to allow their customers to quickly act to protect their personal and financial information.

The leaked data includes the names, addresses, account details, email addresses, and the last four digits of credit card numbers of millions of subscribers to Dow Jones publications like The Wall Street Journal. 1.6 million entries in the suite of databases Dow Jones Risk & Compliance were also leaked. These programs are used heavily by financial organizations for compliance with anti-money laundering regulations.

The exposed repository, an Amazon Web Services S3 bucket, had been configured through the permissions settings to allow any AWS ‘Authenticated User’ to download the data via the repository’s URL. Small problem with that: by Amazon's definition, an ‘Authenticated User’ is ‘any user that has an Amazon AWS account’, allowing millions of users to register with AWS to access this information for free.


Read this article on InfoSecurity Magazine




NNT Suite of Products

change tracker gen7r2 logo

Combine industry leading Device Hardening, File Integrity Monitoring, Change Control, Configuration Management & Compliance Management into one easy to use solution that can scale to the most demanding environments!

fastcloud logo

Automatically evaluate and verify the authenticity of file changes in real-time with NNT FAST™ (File Approved-Safe Technology) Integrity Assurance.

log tracker logo logo

Comprehensive and easy to use security information & event log management with intelligent & self-learning correlation technology to highlight potentially harmful activity in seconds.

vulnerability tracker logo

Continuously scan and identify vulnerabilities with unparalleled accuracy and efficiency, protecting your IT assets on premises, in the cloud and mobile endpoints.

USA Offices
New Net Technologies LLC
Suite #10115, 9128 Strada Place
Naples, Florida, 34108
1175 Peachtree St NE
Atlanta, Georgia, 30361.
4145 SW Watson, Suite 350
Beaverton, Oregon, 97005.

Tel: (844) 898-8358
email [email protected]
UK Office
New Net Technologies Ltd
Rivers Lodge, West Common
Harpenden, Hertfordshire

Tel: 01582 287310
email [email protected]
CIS benchmarking SEWP Cybersecurity 500Sans Institute Now Certified IBM Security
Copyright 2019, New Net Technologies LLC. All rights reserved. 
NNT and Change Tracker are registered trademarks of New Net Technologies LLC.
All other product, company names and trademarks are the property of their respective owners.