Data Breaches

On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association.

A comprehensive breakdown of all the events unfolding from the Medibank data breach.

UpGuard can now report an ElasticSearch instance used as data storage for the debt collection system ENCollect has been secured. The server contained data about loans from multiple Indian and African financial services companies that had apparently been sent to ENCollect for collection. The data totalled 5.8GB in storage size and contained a total of 1,686,363 records. Those records included personal information like name, loan amount, date of birth, account number, and more.

UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs.

38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses.

UpGuard can now disclose that an Amazon S3 storage bucket containing publicly exposed backups of systems representing the intranet and web presence for Martin County, Florida has been secured.

Several large storage buckets under the control of Hortonworks were configured for public access, exposing credentials and other internal data.

Data from TVSmiles, a German mobile application for delivering gamified advertisements, exposed a database including personally identifiable information.

The source code for a voter contact app was left publicly accessible, exposing credentials, code, and the app's development history.

A collection of data sets detailing the purchasing habits and consumer behavior profiles of 120 million American households was exposed by Tetrad.

An AWS engineer uploaded personal information and system credentials to GitHub. UpGuard notified AWS Security to secure the data.

Everyone who depends on tech assumes its risks. The justice system is no exception. See how detailed arrest records for South Carolina were exposed online.