Unlocked S3 Bucket Lets 36,077 Jail Files Escape

Researchers found a misconfigured Amazon S3 bucket leaking sensitive data belonging to inmates of correctional facilities in Florida, Kentucky, Missouri, Tennessee, and West Virginia. Investigators are working to determine the status of other potentially affected state jails.

The leaky repository, discovered by vpnMentor's research team on January 3, belongs to JailCore, a cloud-based management and compliance platform commonly used in US correctional facilities. It contained 36,077 records of sensitive inmate data including full names, mugshots, inmate IDs, booking numbers, activity logs, and a host of personal health information. The bucket was sealed by January 16, following disclosure to JailCore on January 5 and the Pentagon on January 15.

Data exposed in this incident includes medical records, which specify the drugs inmates are prescribed and taking during their incarceration. The bucket contained medicine names, dosages, and whether the patient accepted the drug. Full names of drug administrators and signatures of correctional officers were also compromised in the leak. While some state jails' inmate data is made publicly accessible; for example, current inmate rosters, medical data, and other personally identifiable information is not.

Read more details here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "What Is a Privileged Access Workstation (PAW)?."