In August 2018, John McAfee boasted about the Bitfi crypto wallet app being “unhackable” and it didn’t take hackers much to hack the wallet app twice forcing the company to remove the “unhackable” tag.
Now, a Cloud backup provider has leaked a treasure trove of customer data while claiming to be “The World’s Most Secure Online Backup” service provider. – Oh, the irony.
Going by the name of SOS Online Backup; the secure cloud-based backup provider is based in El Segundo, California with data centers in every continent of the world which indicates what type of industry giant the company is.
However, according to a team of researchers from vpnMentor, SOS Online Backup has exposed personal records of over 135 million customers online.
SOS Online Backup claiming to be “The World’s Most Secure Online Backup” service provider:
In total, the researchers identified around 70GB worth of data belonging to the company’s user accounts. This included:
Full names
Usernames
Phone numbers
Email addresses
Internal company details (corporate customers)
The exposed database contained over 135 million records, totaling almost 70GB of metadata related to user accounts on SOS Online Backup. This included structural, reference, descriptive, and administrative metadata covering many aspects of SOS Online Backup’s cloud services, wrote vpnMentor’s in a blog post.
The worrisome part of this incident, other than the data leak, is the attitude of SOS Online Backup. For instance, vpnMentor’s research team discovered the database in November 2019 and after identifying its owner, informed the company twice on December 10th, and December 17th, 2019 yet SOS Online Backup never responded to the researchers neither did they protect the database.
On December 19th however, the data was protected by the company without responding or acknowledging the breach.
Although it is unclear if the database was accessed by third-party with malicious intent, if it was, it exposes customers to real-life blackmailing, extortion, and identity theft-related scams.
Due to the size of the database, there’s potential it affected SOS Online Backup users around the world, impacting their entire user base, researchers warned.
The database can also end up on the dark web and hacking forums just like HackRead.com exclusively reported how 42 million Iranian phone numbers are currently being sold online after a researcher identified them exposed on an unprotected Elasticsearch server.
In a conversation with HackRead.com, Raif Mehmet, AVP at Bitglass said that, “Misconfigurations like this one will continue to be a rampant issue as businesses continually fail to obtain visibility and control into all of their cloud footprints. Time and again, cloud misconfiguration issues allow servers to expose sensitive data that is not protected or encrypted, enabling unauthorized access and a host of other headaches for the enterprise and its data subjects.”
“A recent Gartner report cited that 99% of cloud security failures will be the customer’s fault through 2025, and consequently misconfigurations will continue to be a leading cause of data leakage across all organizations,” Raif warned.
Raif advised that, “to prevent future incidents and protect customer data, organizations need to have full visibility and control over their customers’ data. This can be accomplished by leveraging multi-faceted solutions that enforce real-time access control, detect misconfigurations through cloud security posture management, encrypt sensitive data at rest, manage the sharing of data with external parties, and prevent data leakage.”
If you are an SOS Online Backup’s customer it’s time to get in touch with the company, inquire about the breach and question their security measures. As for SOS Online Backup as a business, the incident can be devastating starting with GDPR and customers mistrust who uploaded their highly sensitive records on the site.
This, however, is not the first time when a “secure cloud backup” firm has leaked customers’ data online. A few days ago, Data Deposit Box., a Canadian secure cloud storage provider leaked 270,000 personal files uploaded by the company’s customers using its secure cloud storage service.
Did you enjoy reading this article? Kindly do like our page on Facebook and follow us on Twitter.
