Conor Reynolds reports: Package Holiday firm Truly Travels exposed over 200,000 customer phone call recordings and data files on a publicly accessible server. Over 530,000 data files were discovered in an unsecured Amazon Web Services server. Of these files 212,000 were audio files that held recordings of Teletext customers who had contacted the firms India-based…
Category: Business Sector
Privacy Snafu Exposes UK Holidaymakers’ Data for Three Years
Phil Muncaster reports: The personal details of over 200,000 customers of a British holiday firm were left exposed in audio files for several years, according to a new report. Truly Travels, which trades under the name Teletext Holidays, is unusual in that consumers browse its website for package deals before completing their order over the…
Over 47,000 Supermicro servers are exposing BMC ports on the internet
Catalin Cimpanu reports: More than 47,000 workstations and servers, possibly more, running on Supermicro motherboards are currently open to attacks because administrators have left an internal component exposed on the internet. These systems are vulnerable to a new set of vulnerabilities named USBAnywhere that affect the baseboard management controller (BMC) firmware of Supermicro motherboards. Read…
Data Leak Hits 2.5 Million Customers of Cosmetics Giant Yves Rocher
Phil Muncaster reports: A French retail consultancy exposed data on millions of its clients’ customers as well as sensitive business information, after researchers discovered an unsecured Elasticsearch database. Aliznet, which specializes in digital transformation, names the likes of tech giants IBM, Oracle and Salesforce, retail leaders like Auchan, and big brands including Yves Rocher and…
XKCD forum goes offline after discovery of data leak affecting 562K members
Ravie Lakshmanan reports: XKCD forum, the bulletin board associated with the popular webcomic XKCD, has been taken offline after personal information of more than 562,000 members was exposed online. According to security researcher Troy Hunt, the breach occurred two months ago (on July 1 2019). The compromised data has been added to breach alerting site…
Malicious websites were used to secretly hack into iPhones for years, says Google
Zack Whittaker reports: Security researchers at Google say they’ve found a number of malicious websites which, when visited, could quietly hack into a victim’s iPhone by exploiting a set of previously undisclosed software flaws. Google’s Project Zero said in a deep-dive blog post published late on Thursday that the websites were visited thousands of times…