CYBER BREACH: Millions of Users’ Website Traffic Exposed in Data Breach
Syndicated By Iain Fraser Cybersecurity Journalist - Málaga City
Our friends at the Website Planet research team discovered a critical data exposure affecting an organization using an open-source data analytics software that allows entities to gather and analyse information about their websites’ visitors.
Two ElasticSearch servers owned by an unknown organization using this software were left unsecured, exposing data related to website visitors.
Web analytics tools collect a vast amount of data to build a detailed profile for each website visitor. Even though websites often collect this information without users knowing, the servers demonstrate that these detailed user profiles can be exposed. As such, users must take adequate steps to protect their privacy when using the internet.
Customer Data Exposed
The ElasticSearch servers were misconfigured; left without any user authentication controls or encryption in place. As such, the unsecured ElasticSearch servers exposed 359,019,902 total records, equating to 579.4 GB of data.
Both of the unknown organization’s ElasticSearch servers contained detailed logs of website user traffic — information that belongs to users of various websites collecting data with the open-source technology.
Website user traffic found on the server included:
- Geolocation data
- Web page visited
- Referrer page
- Timestamp IP
- User agent data of website visitors
The servers contained user information collected over two months in 2021. The first server contained September 2021 data and the second server featured December 2021 data.
The September 2021 server consisted of 242,728,328 records, totalling 389.7 GB of data, and this data was collected between September 2nd, 2021, and October 1st, 2021.
The December 2021 server featured 116,291,574 records, totalling 189.7 GB of data, and was collected between December 1st, 2021, and December 27th, 2021.
People could be located through each server’s logs of user profiles. Users could be filtered based on their IP addresses and, from here, the server disclosed extensive details about each user’s passive digital footprint — information that’s collected from internet users without them knowing, such as web-browsing activity.
Exposed users appeared in 4 to 100 records on average across the two servers. Considering the presence of multiple logs for each user, we estimate there are around 15 million people affected by the misconfigured ElasticSearch servers.
Two factors could impact our estimated figure. Firstly, a number of each server’s user profiles belonged to bots that were crawling each website, including Googlebot and Pinterest Bot. The presence of bots could lower our estimate, though, only by a small amount. Secondly, exposed users were distinguished through their IP addresses, so any website visitors using a VPN or Tor may be included in our “people affected” estimate but wouldn’t be exposed. In practice, these two factors likely balance out to some degree.
The servers were live and were being updated at the time of discovery. ElasticSearch is not at fault for this data exposure, and neither is the company providing the open-source web-analytics technology that was used to harvest the data. Learn More/...
About Website Planet
Website Planet is the number one resource for web designers, digital marketers, developers, and businesses with an online presence. You’ll find tools and resources for everyone, from beginners to experts — and honesty is our top priority.
We have an experienced team of ethical security research experts who uncover and disclose serious data leaks as part of a free service for the online community at large. This has included a breach in a medical AI platform, as well as a breach in a French real estate agency leaking sensitive data.
