Industry News: ESG5

The target: United Nations Environmental Programme (UNEP)

The take: 100,000 records containing: employee personally identifiable information, project funding records, employment evaluation records, and most critically 7 sets of administrative credentials to other databases.

The attack vector: The leak originated from an unsecured Git directory and credential files (Git is one of the world’s most popular software version control systems). Within these exposed files were unencrypted, plain text administrative passwords for not only the repository which was accessed, but for other datasets and systems as well.

This breach demonstrates the importance of appropriate credential storage – privileged credentials should never be stored in plaintext scripts or configuration files replicated in git repositories. Data must always be held with security controls commensurate to the sensitivity of that data.

Read more...