Researchers found an unprotected database containing sensitive customer data It belongs to Apisec, a company that specializes in API -Security Testing Affected customers were allegedly notified
Apisec, a company that specializes in proactive, automated and continuous API safety tests, may have inadvertently leaked sensitive customer data online, experts have said.
The discovery was first made by cyber security researchers Upguard and later confirmed by the company itself.
The data was stored in an Internet associated database that was not password -protected, and has apparently remained such in “several” days before they were locked as soon as Upguard informed Apisec.
Notification of affected customers
As the company tracks its customers’ APIs for security weaknesses, most of the data were generated by its own products.
Some of the data dated back to 2018 and included both customer employees and users’ names, E email addresses and API security position information. Since this data included things as if 2FA was activated, it is the type of information that may prove to be very useful to a threat actor.
APISEC reportedly first tried to tone down the importance of the incident and said the database held “test data”, that it was not the company’s production database and that it did not have customer data but changed its attitude when presented with information that suggested otherwise.
Apparently, Upguard found evidence that the database also had data from real world customers, including names and emails and scan results.
When Techcrunch Shared the information with Apisec, they later said that the notified customers whose personal information was found in the data. However, it did not want to say how many people were affected, nor did it want to share a copy of the letter of violation notification.
Unprotected databases continue to be one of the main causes of sensitive data leaks. Many organizations use the cloud to host information about their employees, clients or customers, and forget the fact that Cloud Hosting works on a shared responsibility model.
You also like
