A database with millions of customer records was found exposed on an unprotected server, allowing it to be read by anyone who knew how to do it. The data contained were 445 million customer files of Veeam, a Sweden-based company that provides data management services for virtual or physical servers, as well as for cloud infrastructures.
Security researcher Bob Diachenko discovered the database on Amazon Cloud on September 5. 4 days later the database disappeared, which may mean that Veeam realized its mistake and fixed it.
We can't know for sure how long the database was exposed, but according to Bob Diachenko, the server was indexed by Shodan on August 31st.
The data contained in the database were personal information of the customers, such as for example name, surname, email address and country of residence. Also for some of the customers there were corporate data such as the type of company, IP addresses and some logs.
In his attempt to understand who the exposed server belongs to, Diachenko, studying the database, found records that were logged up to 4 years ago. Veeam is a company with more than 300,000 customers, among which is Scania.
“It fell to our perception that one of our databases containing non-sensitive data might have been accessed by third parties for a short period of time. We are now confident that all our databases are well locked and secure. Veeam takes data privacy very seriously, and for that reason has started an investigation.” The company said in a statement.
