Massive Data Breach: Online Gift Card Store Leaks Hundreds of Thousands of Identity Documents

Massive Data Breach: Online Gift Card Store Leaks Hundreds of Thousands of Identity Documents

In a significant security breach, a U.S. online gift card store has unintentionally exposed sensitive customer data, including government-issued identity documents, due to a misconfigured online storage server. This incident raises serious concerns about data privacy and compliance with anti-money laundering regulations.

Details of the Security Lapse

A security researcher known as JayeLTee discovered the exposed storage server late last year, which contained a staggering amount of sensitive information. This included:

  • Driving licenses
  • Passports
  • Other government-issued identity documents

The data belonged to MyGiftCardSupply, an online platform that allows customers to purchase digital gift cards for various popular brands and services.

Compliance and KYC Checks

According to MyGiftCardSupply’s website, customers are required to upload copies of their identity documents to comply with U.S. anti-money laundering (AML) regulations, commonly referred to as “know your customer” (KYC) checks. Unfortunately, the storage server housing these documents was left unsecured and accessible without a password, exposing the sensitive data to the public.

Response from MyGiftCardSupply

JayeLTee brought the data breach to the attention of TechCrunch after MyGiftCardSupply failed to respond to his initial communication regarding the security issue. Upon inquiry, MyGiftCardSupply’s founder Sam Gastro confirmed the breach and stated:

“The files are now secure, and we are doing a full audit of the KYC verification procedure. Going forward, we are going to delete the files promptly after doing the identity verification.”

However, Gastro did not disclose how long the data had been exposed or whether the company would notify the affected individuals.

Extent of the Data Exposure

According to JayeLTee, the exposed data was hosted on Microsoft’s Azure cloud and included:

  • Over 600,000 front and back images of identity documents
  • Selfie photos of around 200,000 customers
READ ALSO  Google Acquires Wiz for $32B: Major Move to Strengthen Cloud Security

The most recent document uploaded was dated December 31, 2024, indicating the server was actively used just before it was secured. This incident highlights the ongoing vulnerabilities associated with KYC checks, which are essential for verifying customer identities.

Context Within Recent Data Breaches

This incident is part of a troubling trend of data breaches involving identity documents. In a notable case last April, a hacker allegedly stole a vast screening database called World-Check, used to assess customer risk levels. The leaked data included:

  • Names
  • Dates of birth
  • Passport and Social Security numbers
  • Bank account numbers

Additionally, JayeLTee reported another data exposure incident involving Roomster, a roommate-finding site, where around 320,000 identity documents were similarly compromised. The company claimed no evidence of malicious access to the data.

Conclusion

This ongoing issue with data security underscores the necessity for robust protective measures and compliance with regulations in handling sensitive customer information. As companies like MyGiftCardSupply and Roomster navigate these challenges, vigilance and transparency will be crucial in restoring customer trust.

For more information on data security best practices, visit CISA.

Source link

Similar Posts

Data Breach Alert: DISA Reveals Hackers Compromised Personal Information of Over 3 Million Employees

Data Breach Alert: DISA Reveals Hackers Compromised Personal Information of Over 3 Million Employees

Bysupport

DISA Global Solutions has reported a data breach affecting over 3.3 million individuals, raising concerns for organizations relying on its employee screening services. The breach, confirmed on April 22, 2024, involved unauthorized access to DISA’s systems beginning February 9, 2024, remaining undetected for over two months. Compromised data includes Social Security numbers, financial information, and government-issued IDs. Over 360,000 residents from Massachusetts were affected. Despite an investigation, DISA could not determine the exact data accessed. The identity of the attackers is unknown, and DISA has not responded to inquiries regarding the incident. Affected individuals are advised to monitor their accounts for identity theft.

US Army Soldier Admits Guilt in Major AT&T and Verizon Cyber Hacking Scandal

US Army Soldier Admits Guilt in Major AT&T and Verizon Cyber Hacking Scandal

Bysupport

Cameron John Wagenius, a former U.S. Army soldier, has pleaded guilty to hacking into AT&T and Verizon, unlawfully accessing confidential phone records. He faces up to ten years in prison and a $250,000 fine for each of the two counts. His case is linked to other alleged hackers involved in significant data breaches, including those affecting the cloud services company Snowflake. U.S. attorney Tessa Gorman noted that the breaches at AT&T and Verizon resulted from the same intrusion efforts. The attacks compromised sensitive information from over 160 companies, highlighting the urgent need for enhanced cybersecurity measures.

Protect Your Privacy: How to Detect and Remove Stalkerware from Your Android Phone

Protect Your Privacy: How to Detect and Remove Stalkerware from Your Android Phone

Bysupport

Consumer-grade spyware apps pose a serious threat to Android users by secretly monitoring private information, including messages and locations. Often marketed as family-tracking tools, these apps, known as stalkerware, can be difficult to detect as they may hide from the home screen. Signs of compromise include unusual phone behavior and excessive data usage. To identify and remove spyware, users should enable Google Play Protect, review accessibility services, check notification access, inspect device admin settings, and uninstall suspicious apps. Strengthening device security with strong passwords and two-factor authentication is also recommended. For support, contact the National Domestic Violence Hotline.

Microsoft Files Lawsuit Against Group for Allegedly Creating Tool to Exploit AI Service

Microsoft Files Lawsuit Against Group for Allegedly Creating Tool to Exploit AI Service

Bysupport

Microsoft has filed a lawsuit against ten unidentified individuals accused of creating tools to bypass safety measures in its Azure OpenAI Service. The complaint, filed in December, alleges violations of the Computer Fraud and Abuse Act and the Digital Millennium Copyright Act, involving unauthorized access to Microsoft’s software to generate harmful content. The defendants reportedly exploited stolen customer API keys and developed a tool, named de3u, enabling users to generate images without coding while evading Microsoft’s content filters. Microsoft has since seized a related website and enhanced safety protocols to address these security breaches.

North Korea's 2024 Crypto Heists: How $659M Was Stolen Through Fake Job Scams

North Korea’s 2024 Crypto Heists: How $659M Was Stolen Through Fake Job Scams

Bysupport

In 2024, hackers linked to North Korea have stolen at least $659 million in cryptocurrency through various attacks, highlighting an increasing threat in the digital currency sector. A joint statement from the U.S., Japan, and South Korea confirmed North Korea’s involvement in the $235 million WazirX hack, which led to the suspension of trading on India’s largest exchange. Other notable thefts included $308 million from DMM Bitcoin and $50 million from Upbit. The Lazarus Group employed tactics like social engineering and malware. North Korean cyber activities have reportedly funded nuclear programs, with 61% of cryptocurrency thefts in 2024 attributed to them, totaling $1.34 billion.

Italian Government Reveals Paragon Spyware Targeting Citizens Across Europe

Italian Government Reveals Paragon Spyware Targeting Citizens Across Europe

Bysupport

A recent spyware campaign uncovered by WhatsApp, linked to Paragon Solutions, has sparked privacy concerns in Europe, particularly in Italy. The Italian government, led by Prime Minister Giorgia Meloni, has denied involvement in targeting citizens, including journalist Francesco Cancellato and activist Luca Casarini. The National Cybersecurity Agency (ACN) reported seven mobile users in Italy affected by the spyware, which also targeted individuals across multiple European countries. WhatsApp revealed around 90 users were impacted globally. Paragon Solutions, which sells surveillance technology, maintains a policy against targeting journalists and civil society members but has not commented on the allegations.