Another misconfigured database left a lot of tourists vulnerable to identity theft. Researchers at Kromtech Security Research Center discovered a data leak that exposed sensitive information on more than 455,000 tourists into Mexico and made it available to anyone who may have been looking to steal it. The database was an Apache CouchDB server and was connected to MoneyBack, a service provider that refunds sales tax to tourists visiting Mexico.
In this case, it wasn’t a hacker beating a system up until he broke the outer defenses. Instead, it is an example of accidental data exposure. Someone simply didn’t configure the product correctly and left a hole in it. However, if someone did access the information that was stored there, identity theft may still occur, if it hasn’t already.
The information included scanned passports, identification cards, payment cards, as well as other documents. It also included 88,623 unique passport ID numbers.
Fortunately, the exposure was discovered during a routine audit, which may mean the risk of someone selling it on the Dark Web or using it to commit identity theft was lessened. However, it isn’t known if anyone did snag it or if MoneyBack got lucky and it’s all safe and sound now.
Properly configuring databases is critical. In the past, several companies have left sensitive information available for the taking with misconfigured MongoDB. It’s worth the effort to not only ensure they are properly configured them, but also to test them and keep them patched and updated at all times.
The value added tax (VAT) is what tourists to many countries pay on goods purchased while they are visiting those countries. It is available for refund upon departure. In this case, those visiting Mexico from the U.S., Argentina, Canada, Columbia, and Italy were the most affected.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
