Dow Jones & Company has accidentally leaked the personal details and financial information of at least 2.2 million of its customers, but security experts believe this number is said to increase.
Security researchers at UpGuard found that a cloud-based file repository had been misconfigured to allow semi-public access to 2.2 million customers, however, UpGuard believes the number may be as high as 4 million.
The leak was revealed on May 30 and the database was secured by June 6, however, Dow Jones made little to no effort to notify customers of the incident, aside from an article published in the Journal on July 16 covering the leak. It’s of utmost importance that any organization who experiences a breach notifies their customers immediately to allow their customers to quickly act to protect their personal and financial information.
The leaked data includes the names, addresses, account details, email addresses, and the last four digits of credit card numbers of millions of subscribers to Dow Jones publications like The Wall Street Journal. 1.6 million entries in the suite of databases Dow Jones Risk & Compliance were also leaked. These programs are used heavily by financial organizations for compliance with anti-money laundering regulations.
The exposed repository, an Amazon Web Services S3 bucket, had been configured through the permissions settings to allow any AWS ‘Authenticated User’ to download the data via the repository’s URL. Small problem with that: by Amazon's definition, an ‘Authenticated User’ is ‘any user that has an Amazon AWS account’, allowing millions of users to register with AWS to access this information for free.
Read this article on InfoSecurity Magazine