Cybersecurity Researcher Jeremiah Fowler discovered an online non-password-protected database that contained more than 1.1 million records for a service that offers dating services, and social networking for military members and their supporters.
Jeremiah Fowler, writing in vpnMentor »
The publicly exposed database was not password-protected or encrypted. It contained a total of 1,187,296 documents. In a limited sampling, a majority of the documents I saw were user images, while others were photos of potentially sensitive proof of service documents. These contained full names (first, last, and middle), mailing addresses, SSN (US), National Insurance Numbers, and Service Numbers (UK). These documents also listed rank, branch of the service, dates, locations, and other information that should not be publicly accessible.
Upon further research, I identified that the records belonged to Forces Penpals, a dating service and social networking community for military service members and their supporters. I immediately sent a responsible disclosure notice, and public access was restricted the following day. It is not known how long the database was exposed or if anyone else gained access to it. Only an internal forensic audit could identify additional access or potentially suspicious activity.
Elsewhere » Bitdefende | Biometric Update
Last Updated on December 13, 2024