Infoseccer: Private security biz let guard down, exposed 120K+ files A London-based private security company allegedly left more than 120,000 files available online via an unsecured server, an infoseccer told The Register. The independent security researcher claimed they had found 124,035 exposed files back in October, totalling 46.48 GB in size and containing details such as PII, payroll data …
It's more of a "no serious harm yet or that we know about". This stuff could be on a disc somewhere forming a small but crucial part of sophisticated social engineering attacks on a whole bunch of poor buggers, some of whom just applied for jobs. We might never "know" the damage that this helped to cause and the tone of their press release is one of shooting the messenger pour discourager les autres. If Assist Security are not punished for this then the ICO should be hauled over the coals.
1. Assist Security wrote that they took actions to secure the "allegedly exposed files".
2. They tarred the messenger with implications said messenger is a bad guy/gal with their use of the phrase, "... data they [JayeLTee] may have unlawfully exfiltrated and be retaining."
As someone who has been reporting on leaks and breaches for 18 years now, Assist Security's statements sound like an attempt to divert from their own accountability for a leak and from the key question right now:
Do they or don't they have access logs that show every access to the data in the last year or from whenever the data were first exposed without authentication required?
This is simple. If they have logs, they don't need the researcher to tell them what he accessed.
If they don't have logs, they should notify everyone because there appears to be a high risk of harm and they don't know how many thousands of people downloaded the data and are saving it to misuse.
So, tell us all, Assist Security: do you have the logs that will show you what IP addresses accessed your data or don't you? Maybe if you send JayeLTee all your logs, he can tell you which IP addresses might be his.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
