Industry News: ESG5

The target: Adobe, an American computer software company.

The take: 7.5 million customer accounts which contained email addresses, account creation dates, subscription status, country and payment details.

The attack vector: A misconfigured Elasticsearch cloud database was left online without any password protection. This information could easily be used to launch sophisticated, targeted phishing attacks to trick users into giving further sensitive details.

When provisioning new systems or types of systems, care must be taken to ensure that appropriate and proportionate security measures are implemented, either by automated scanning or by manual review. Adopting (and validating) robust controls to technological tools employed is critical to secure operations. 

Read more...