1.2B Records Exposed in Massive Server Leak

Security researchers have discovered an unsecured server containing 4 terabytes of personal data — 1.2 billion records in total — exposed and easily accessible online, Wired reported today.

The open server held profiles of hundreds of millions of people. Leaked data includes home and cellphone numbers; social media profiles for Facebook, Twitter, LinkedIn, and Github; work histories seemingly pulled from LinkedIn; nearly 50 million unique phone numbers; and 622 million unique email addresses. It didn't contain sensitive data such as credit card numbers, Social Security numbers, or passwords, which are considered relatively more valuable to attackers.

It seems this trove of information is made up of four separate datasets. Of these, three had labels indicating they were from People Data Labs, a data broker claiming to sell information on more than 1.5 billion people, including billions of email addresses and Facebook URLs and IDs.

Security researcher Vinny Troia discovered the server while scanning for exposures with researcher Bob Diachenko. It's unclear who owned the server, which traced back to Google Cloud Services, or who stored the information there. It's also unclear whether anyone had found and downloaded it. Troia alerted the FBI, and the server and data were taken down.

In these scenarios, the leaked data often comes from public records, and its exposure doesn't necessarily mean it's in criminal hands. Still, aggregating information like this can make it easier for fraudsters to steal identities or launch credential stuffing attacks and phishing scams. It's likely some data will end up on the Dark Web, where it can be bought and sold by scammers. 

Read more details here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "In the Market for a MSSP? Ask These Questions First"