According to security, a misconfigured cloud storage bucket has been discovered responsible for leaking the personal information of hundreds of social media influencers.
A team at vpnMentor discovered the AWS S3 bucket in question , which was open, unencrypted, and unpassworded . The discovery was made in early November. What's worrying is that the company responsible ( 21 Buttons ) has yet to take action.
Various social media influencers upload their photos to the app and are linked to e-commerce stores, where users can purchase the clothes the influencers are wearing in the photos.
According to vpnMentor, 21 Buttons has around two million monthly active users and works with some of the biggest brands in Europe
According to the researchers, the AWS S3 bucket has exposed at least 50 million files, which are mainly photos and videos of influencers, but also hundreds of invoices said to be related to payments made by social media stars.
The personal information that has been exposed includes: full names, zip codes, bank details, ID numbers, PayPal email addresses, etc.
Among the social media influencers whose data was exposed are: Carlota Weber Mazuecos, Freddy Cousin Brown, Marion Caravano, Irsa Saleem and Danielle Metz. All of them have millions of followers.
The vpnMentor team warned that if cybercriminals obtain the exposed personal information, influencers will be in a very difficult position, since their details can be used for phishing and other scams, such as identity theft or bank fraud.
" If invoices are exposed online, criminals will have ample material to identify private accounts held by influencers, while also being able to determine where their homes and workplaces are located ," the researchers said
“This means that those affected are not only vulnerable to phishing and scams. There is also a risk of privacy violations, doxing, stalking and harassment – both online and offline.“.
Source: Infosecurity Magazine
