Shoemaker Ecco leaks almost 60GB of customer data
Misconfigured database leaked sensitive customer data
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Shoemaker Ecco has been operating a misconfigureddatabasefor more than a year, exposing a huge tranche of sensitive information to whoever knew where to look.
This is according to a new report fromCybernews, whose research team recently identified 50 Ecco indices exposed to the public. In total, the database has had more than 60GB of sensitive data that’s been available since June 2021.
“Millions of sensitive documents, from sales to system information, were accessible. Anyone with access could have viewed, edited, copied and stolen, or deleted the data,” the researchers said.
API requests
While Ecco moved in to remedy the problem in the meantime, they did not comment on Cybernews’ findings. The database seems to be locked now, the researchers said.
While scanning the web for unsecured and otherwise misconfigured databases, the research team found an exposed instance hosting Kibana, an ElasticSearch visualization dashboard, for Ecco. Kibana, as the researchers explained, helps process ElasticSearch information.
The instance hosting the dashboard was guarded by an HTTP authentication, but the server was (mis)configured in a way that allowed API requests through. Using this loophole, the researchers looked up the index names on Ecco’s ElasticSearch, seeing 50 exposed indices with more than 60GB of data.
Many data breaches are being caused by misconfigured clouds>Misconfigured web apps exposed millions of US personal records online>These are the best endpoint protection software today
The data contained all kinds of sensitive information, from sales and marketing, to logging and system information, the researchers said. One index, sales_org, contains more than 300,000 documents. A directory called market_specific_quality_dashboard held more than 820,000 records.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
There are multiple ways a threat actor could make use of the database, they further explained, saying that the visible code could have been changed, as well as naming, and URLs, all to run phishing campaigns,identity theft, or to trick people into running malware and ransomware.
What’s more, the database is not for a local Ecco outpost, but rather for the global ecco.com website. In the hands of an experienced cybercriminal, the files could be a major tool in attacking the company globally. Ecco stores, its employees, as well as clients and customers.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Another reason to avoid edge-lit 4K TVs: they may fail faster than others, according to this report
