Yesterday, researchers at vpnMentor revealed that a large amount of personal data has been leaked online. The personal information belongs to customers PayMyTab The leak appears to have been caused by an unprotected AWS bucket.
Researchers discovered that in addition to personal data, some of the customers' financial information was also leaked
Apparently, PayMyTab did not follow Amazon 's security protocols , resulting in it using an unprotected Amazon Web Services (AWS) S3 bucket.
The person who informed vpnMentor about the leak did not give his name. But he said he did it to draw attention and show that companies need to protect their databases and systems. Otherwise, anyone will be able to access them, as they are now.
PayMyTab partners with various restaurants to provide card payment terminals. These devices collect some customer data to improve service. However, this information has been leaked online.
The leaked data includes: names, email, phone numbers, order details, restaurant visit-related information, and the last four digits of customers' payment cards.
According to the researchers, the data was exposed from July 2, 2018, to November 2019. We still don't know the exact number of data leaked, but the researchers estimate that around 10,000 customers were affected.
Investigators were notified of the incident on October 18 and contacted PayMyTab twice, on October 22 and 27.
“As ethical hackers, we have an obligation to notify a company when we discover vulnerabilities,” the researchers say. “This is especially true in cases where the data breach involves such personal information. However, this ethics also means that we have a responsibility to the world. users ” need to know about the data breach, as it affects many of them.
vpnMentor researchers have discovered other databases that exposed personal information of millions of Ecuadorian citizens, data from sites , information belonging to the US government and military, company emails, and more.
