Unsecured cloud database leaked personal information of over 100m US citizens

An upcoming B2B sales and marketing company leaked personally identifiable information (PII) of up to 126 million US citizens, according to cybersecurity researchers.

Researchers at vpnMentor discovered an unsecured database on Amazon’s cloud computing platform AWS, which they traced back to the US-based marketing company OneMoreLead.

vpnMentor argues that the information in the database, which included email addresses, home address, and phone numbers, and more could easily have been used to perpetrate identity theft, financial fraud, or be used to devise effective phishing campaigns.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

We’ve rounded up the best cloud databases on the market
Also check our list of the best cloud hosting on the market
These are the best ransomware protection tools

Furthermore, the database also contained job titles, name of the employer, and work contact details of the individuals, which vpnMentor believes could be used to conduct business email compromise scams.

Mysterious origins

While OneMoreLead were quick to protect the database once alerted, vpnMentor has also raised questions about the origins of the data.

According to vpnMentor’s report, OneMoreLead claims to have over 40 million clients, although it doesn’t list them on its website. Furthermore, vpnMentor says the company started in 2020 and it’s “unlikely they collected data from 126 million people since opening in 2020.”

Interestingly, vpnMentor says that the exposed data bears an uncanny resemblance to a leak originally linked to German B2B marketing company Leadhunter in 2020, who, back then, had denied ownership of the leaked data.

In any case, the researchers suggest that such leaks from unprotected databases are becoming more common.

“However, any leak like this could be easily avoided with some basic security measures taken including securing servers, implementing proper access rules, and never leaving a system that doesn’t require authentication open to the internet,” suggest vpnMentor researchers, Noam Rotem and Ran Locar.