A noteworthy security flaw in Really Simple Systems, a provider of global B2B CRM services, was discovered revealing millions of client files online. The database was devoid of password protection and exposed over 3 million records, which should ideally remain restricted and confidential.
Cybersecurity researcher, Jeremiah Fowler, stumbled upon the vulnerability and disclosed his findings. He uncovered that the database contained copious amounts of internal invoices, customer communications, and copious content relationship management files stored by customers. The exposure was potentially dangerous, given that it made a profusion of data related to a myriad of organizations, spanning from small businesses to multinational corporations, publicly accessible to anyone with an internet connection.
Detailed Insights into the Exposed Data
A thorough examination of the exposed documents revealed an incredibly wide range of files belonging to diverse organizations and customers across the globe, including the USA, UK, Australia, and several EU countries. Some documents housed potentially sensitive data such as medical records, identification documents, tax documents, real estate contracts, and credit reports which displayed SSN and tax identification numbers. It also contained child psychological examination documents and non-disclosure agreements.
The exposed database also contained over 101,290 invoices, revealing names and addresses of customers, B2B CRM plan details, and other sensitive data. Such exposure stands to be gravely exploited by cybercriminals, posing threats of invoice fraud and phishing campaigns.
The Road to Damage Control and Mitigation
Shortly after detecting the aberration, Fowler issued an immediate disclosure notice of the potential danger to Really Simple Systems. The response from the company was prompt as they expressed gratitude for the notification.
Although a specific folder containing data of a managed educational platform was removed from public access on the same day, Fowler noticed that several other folders remained accessible for a few more days before access was finally restricted. After a subsequent follow-up, he received assurance that further security reinforcement measures were being undertaken to rectify the situation.
Despite receiving an assurance regarding further resolution, the duration of exposure and whether any unauthorized entity accessed the data before the access restriction remains unverified. Fowler, as a cybersecurity researcher, reiterated that security should be of paramount importance to firms, and they should regularly conduct penetration testing and ensure firewall settings are properly configured to restrict public access.
It is essential to implement strong cybersecurity measures like encryption, access controls, regular security audits, employee training, intrusion detection systems, and incident response plans to prevent and manage similar breaches in the future.
