Dow Jones & Company has accidentally leaked the personal details and financial information of at least 2.2 million of its customers, but security experts believe this number is said to increase.

Security researchers at UpGuard found that a cloud-based file repository had been misconfigured to allow semi-public access to 2.2 million customers, however, UpGuard believes the number may be as high as 4 million.

The leak was revealed on May 30 and the database was secured by June 6, however, Dow Jones made little to no effort to notify customers of the incident, aside from an article published in the Journal on July 16 covering the leak. It’s of utmost importance that any organization who experiences a breach notifies their customers immediately to allow their customers to quickly act to protect their personal and financial information.

The leaked data includes the names, addresses, account details, email addresses, and the last four digits of credit card numbers of millions of subscribers to Dow Jones publications like The Wall Street Journal. 1.6 million entries in the suite of databases Dow Jones Risk & Compliance were also leaked. These programs are used heavily by financial organizations for compliance with anti-money laundering regulations.

The exposed repository, an Amazon Web Services S3 bucket, had been configured through the permissions settings to allow any AWS ‘Authenticated User’ to download the data via the repository’s URL. Small problem with that: by Amazon's definition, an ‘Authenticated User’ is ‘any user that has an Amazon AWS account’, allowing millions of users to register with AWS to access this information for free.

 

Read this article on InfoSecurity Magazine

 

 

 

NNT Products
USA Offices
New Net Technologies LLC
Naples
Suite #10115, 9128 Strada Place
Naples, Florida, 34108
Atlanta
201 17th Street, Suite 300
Atlanta, Georgia, 30363.

Tel: 1-888-898-0674
email [email protected]
UK Office
New Net Technologies LLC
Rivers Lodge
West Common
Harpenden
Hertfordshire
AL5 2JN

Tel: 01582 287310
email [email protected]
Connect
Google+ Linkedin Twitter - Change Tracker Facebook rss feed YouTube
CIS benchmarking SEWP Cybersecurity 500 Sans Institute
Copyright 2017, New Net Technologies LLC. All rights reserved. 
NNT and Change Tracker are registered trademarks of New Net Technologies LLC.
All other product, company names and trademarks are the property of their respective owners.