Microsoft Azure breach left thousands of customer records exposed Unbreakable Lock
Thanks to questionable security practises by an app developer, more than half a million sensitive documents of its customers were exposed on the Internet. The documents were housed in an unprotected Microsoft Azure blob storage and could be viewed by anyone with the direct address of the files, without any kind of authentication.
Azure Blob storage is a feature of Microsoft Azure that allows users to store large amounts of unstructured data on Microsoft’s data storage platform.
The unsecured blob was managed by Surrey-based app developer Probase and according to The Register, it contained 587,000 files, ranging from backed-up emails to letters, spreadsheets, screenshots, and more.
Questionable security practises
The Register caught wind of the unsecured blob thanks to security researcher Oliver Hough who was spooked by the lack of security controls on it.
“Finding a storage bucket like this where a provider has lumped all of their clients’ files in a single bucket rather than creating separate storage for each client demonstrates how, in 2020, the basics of secure design are still not being followed,” Hough told The Register:
The blob contained occupational health assessments, insurance claim documents from US firms underwritten by Lloyds of London, and senior barristers’ private opinions about junior colleagues applying for promotion.
More worryingly however the blob also included FedEx shipment security documentation, along with highly sensitive medical data, and at least one passport scan.
When approached, Probase director Paul Brown, did not comment on how long the blob had been left unsecured, but shared that they are working closely with the Information Commissioner’s Office to resolve the issue.
This is just one of the latest instances of data leaks through Microsoft’s Azure blob storage. While the burden of this exposure lies primarily with Probase, there’s also the fact that Microsoft Azure allows careless developers to create such unsecured data silos.
Via: The Register
Thanks to questionable security practises by an app developer, more than half a million sensitive documents of its customers were exposed on the Internet. The documents were housed in an unprotected Microsoft Azure blob storage and could be viewed by anyone with the direct address of the files, without any…
