Over 750 million records exposed by ERP firm data breach — find out if you’re safe
Plenty of sensitive data was sitting unprotected online
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A major Enterprise Resource Planning (ERP) firm from Mexico kept an unprotected database containing sensitive information on hundreds of thousands of users online for anyone to view.
A report from cybersecurity researcher Jeremiah Fowler, who discovered the archive and reported his findings toWebsite Planet, noted the database, available to anyone who knew where to look, contained 769 million records.
These records contained secrets and personally identifiable information, such as API keys, secret keys, bank account numbers, tax identification numbers, and email addresses. The database is 395GB heavy, and belongs to ClickBalance, a software provider offering various cloud-based business services that help with administration automation, accounting, inventory, payroll, and more.
Disruptive potential
Website Planet describes ClickBalance as one of Mexico’s largest ERP technology providers, and as soon as Fowler found the archive and pinpointed its owner, he reached out to the company, which locked it down “within hours.”
Still, it is not known if any malicious players had already discovered it, and whether or not they already used the data in any of their campaigns. Only a detailed forensic investigation can determine that, Fowler argues.
While obtaining tax identification numbers, or bank account numbers, is certainly dangerous, and allows cybercriminals to run fraud campaigns, especially on those withoutidentity theft protection, stealing active email addresses is arguably more valuable, since it allows them to mount phishing attacks through which they can deploy malware, and even ransomware.
Unprotected databases continue to be one of the most common causes of data leaks, despite their disruptive potential. Many large enterprises and government organizations were found to have kept online databases without any safeguards. In one such instance, the entire Brazilian population had their personal information leaked.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
In early January 2024, researchers from Cybernews discovered an unprotected database that held personal information onapproximately 223 million Brazilian citizens.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
This super-cheap HP Victus 15 gaming laptop just dropped to its lowest price yet
