Industry News: ESG5

The target: LimeLeads, a San Francisco-based business-to-business leads generator.

The take: 49 million user records including: full name, title, user email, employer/company name, company address, company total revenue and estimated number of employees.

The attack vector: LimeLeads did not set up a password for the internal database which was hosted on a publicly accessible server, meaning anyone with an internet connection was able to access the data and scrape a copy. The highly specific personal details of the data could lead to extremely effective spear-phishing campaigns targeting high level individuals.

The security of intended internal systems is as critical as external facing ones. Adopting stringent cybersecurity policies across all areas of access, whether internal or external, is crucial to maintaining the integrity, confidential and availability of data.

Read more...