A database containing data of 32 million SKY Brasil customers is available to anyone without password protection.
SKY Brasil is a company that belongs to Vrio, which offers subscription television services in Brazil. It produces television content and has several television channels.
A Brazilian security researcher, Fabio Castro, discovered many servers in Brazil running Elasticsearch that do not require any authentication to retrieve information. Naturally, these databases are the easiest target for hackers to steal information.
According to the security researcher, the information contained in the database included full customer names, email addresses, service login passwords, customer IP addresses, payment methods, phone numbers and addresses.
The size of one of the databases that were discovered was over 429GB and contained highly sensitive information of SKY's customers.
“The data that had been stored on the server included full name, e‑mail, password, subscription TV package (Sky Brazil), the user's IP addresses, personal addresses, payment methods”, said Castro to BleepingComputer. “Among other information the device model, the serial numbers of the device located at the customer's residence, as well as the log files of the entire platform.”
Sky Brazil has made no statement regarding the issue.
