A publicly accessible, unprotected database belonging to car dealership marketing firm Dealer Leads was found to expose 198 million records, including personally identifiable information, Security Discovery reports.
The database contained 413GB of data representing a compilation of information on potential car buyers, vehicles, loan and finance inquiries, log data with IP addresses of visitors, and more.
With thousands of automotive sites, each specifically aimed at a precise buyer demographic or behavioral characteristic, Dealer Leads delivers content relevant and related to the auto industry or specific target keywords.
Founded in 2015 and based in Calabasas, California, Dealer Leads says it provides “high volume, high quality website traffic for franchise and independent car dealerships.”
The exposed database was set to be “open and visible in any browser,” meaning that anyone connected to the Internet could access the data without having to provide administrative credentials.
Security Discovery also revealed that the database contained records with name, email, phone, address, IP, and other sensitive or identifiable information, in plain text.
Information such as IP addresses, ports, pathways, and storage info, the security firm notes, could be exploited by cybercriminals to access deeper into an organization’s network.
The company restricted public access to the database immediately after being notified on the matter, but the data was exposed for an undetermined period of time, when anyone could have accessed the millions of records there.
“It is unclear if Dealer Leads has notified individuals, dealerships, or authorities about the data incident. Because of the size and scope of the network applicants and potential customers may not know if their data was exposed,” Security Discovery notes.
Related: Unprotected Database Exposes Details of Honda’s Internal Network
Related: Unprotected Database Stored Information on 80 Million U.S. Households
More from Ionut Arghire
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Google Temporarily Offering $180,000 for Full Chain Chrome Exploit
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Adobe Inviting Researchers to Private Bug Bounty Program
- Critical Vulnerabilities Found in Faronics Education Software
- Chrome 114 Released With 18 Security Fixes
- Spyware Found in Google Play Apps With Over 420 Million Downloads
- Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
Latest News
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Google Temporarily Offering $180,000 for Full Chain Chrome Exploit
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
