The target: Reindeer, a U.S-based online marketing company.
The take: The exposure of 50,000 records of Personally Identifiable Information including: names, addresses, date of birth, email addresses, Facebook ID’s, and phone numbers.
The attack vector: Reindeer failed to secure this AmazonS3 bucket with any credential management whatsoever, allowing anyone with an internet connection to access the data.
While Reindeer is no longer in operation, the data they held belonged to firms that are currently operating, and this breach highlights not only the necessity of robust credential controls, but also the risks of using third party vendors. Up to date monitoring on where and what systems a firm’s data resides on is essential for maintaining the expected industry standard of cybersecurity.