The target: Artwork Archive, an online platform used to connect artists and buyers based in Denver, Colorado.
The take: 200,000 records of Personally Identifiable Information including: first and last name, physical addresses, email addresses, phone numbers, and purchase details with sales agreements.
The attack vector: An unsecured Amazon S3 storage server was misconfigured, allowing anyone with an internet connection to access and download the data.
The exposure of personal information can lead to highly targeted phishing and fraud attacks. Given how detailed the information was in this exposure, the threat of spear-phishing campaigns is high. Use of authentication protocols is an integral part of maintaining a rigorous cybersecurity posture, and it is critical to employ industry standard practices of credential management, user authentication and validation, around all storage of customer data.