A publicly accessible, unprotected database belonging to car dealership marketing firm Dealer Leads was found to expose 198 million records, including personally identifiable information, Security Discovery reports.
The database contained 413GB of data representing a compilation of information on potential car buyers, vehicles, loan and finance inquiries, log data with IP addresses of visitors, and more.
With thousands of automotive sites, each specifically aimed at a precise buyer demographic or behavioral characteristic, Dealer Leads delivers content relevant and related to the auto industry or specific target keywords.
Founded in 2015 and based in Calabasas, California, Dealer Leads says it provides “high volume, high quality website traffic for franchise and independent car dealerships.”
The exposed database was set to be “open and visible in any browser,” meaning that anyone connected to the Internet could access the data without having to provide administrative credentials.
Security Discovery also revealed that the database contained records with name, email, phone, address, IP, and other sensitive or identifiable information, in plain text.
Information such as IP addresses, ports, pathways, and storage info, the security firm notes, could be exploited by cybercriminals to access deeper into an organization’s network.
The company restricted public access to the database immediately after being notified on the matter, but the data was exposed for an undetermined period of time, when anyone could have accessed the millions of records there.
“It is unclear if Dealer Leads has notified individuals, dealerships, or authorities about the data incident. Because of the size and scope of the network applicants and potential customers may not know if their data was exposed,” Security Discovery notes.
Related: Unprotected Database Exposes Details of Honda’s Internal Network
Related: Unprotected Database Stored Information on 80 Million U.S. Households
More from Ionut Arghire
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- US, Israel Provide Guidance on Securing Remote Access Software
- Blumira Raises $15 Million for SMB-Tailored XDR Platform
- KeePass Update Patches Vulnerability Exposing Master Password
- Google Workspace Gets Passkey Authentication
Latest News
- Consolidate Vendors and Products for Better Security
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- BBC, British Airways, Novia Scotia Among First Big-Name Victims in Global Supply-Chain Hack
