Cybersecurity researchers say UK-based document printing and binding company Doxzoo exposed hundreds of gigabytes of information, including documents related to the US and British military, by leaving an AWS S3 bucket unprotected.
vpnMentor researchers claim they have discovered 343GB worth of files on an AWS server belonging to Doxzoo. They say the company was notified on January 26, but it never responded and the leak was only addressed on February 11, nearly a week after AWS was contacted.
According to vpnMentor, the unprotected server stored more than 270,000 records, and the incident could impact over 100,000 users. The exposed data included names, addresses, email addresses, passport scans, partial payment information, order details, copyrighted publications (e.g. books, screenplays, TV show scripts), teacher’s guides, certifications and diplomas, medical documents, floor plans, personal photos, and documents that users likely paid for, such as university course materials and diet and exercise plans.
Internal US and UK military documents were also exposed, including classified documents. In addition to the UK and the US, some of the files appeared to belong to individuals in India, Nigeria and Sri Lanka.
“The data leak includes print jobs for many high-profile clientele, including elite universities, US and UK military branches, Fortune 500 companies, and many, many more,” vpnMentor said in a blog post. “On their website, Doxzoo boasts ISO accreditation for, among other things, security, and prides themselves on keeping their customers’ documents in ‘safe hands.’”
vpnMentor added, “The items contained this leak often hold private and/or confidential information within. The promise of secure facilities and systems are key selling points for clients such as the military, and the breach of that guarantee is not only a failure in service, but also potentially holds a security risk along with it.”
SecurityWeek has reached out to Doxzoo for comment, and while the company has confirmed receiving our email, it has yet to respond.
vpnMentor has identified a significant number of unprotected databases over the past year. The company revealed last week that it recently discovered over 500,000 sensitive legal and financial documents exposed by two connected financial services companies.
Related: E-Commerce Company Gearbest Leaked User Information
Related: Millions of Unencrypted Fingerprint and Facial Biometrics Found on Unsecured Database
Related: Unprotected Database Stored Information on 80 Million U.S. Households
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- FDA Announces New Cybersecurity Requirements for Medical Devices
- Mandiant Investigating 3CX Hack as Evidence Shows Attackers Had Access for Months
- Unpatched Security Flaws Expose Water Pump Controllers to Remote Hacker Attacks
- 3CX Confirms Supply Chain Attack as Researchers Uncover Mac Component
- OpenSSL 1.1.1 Nears End of Life: Security Updates Only Until September 2023
- Google Links More iOS, Android Zero-Day Exploits to Spyware Vendors
- ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation
- Thousands Access Fake DDoS-for-Hire Websites Set Up by UK Police
Latest News
- Italy Temporarily Blocks ChatGPT Over Privacy Concerns
- FDA Announces New Cybersecurity Requirements for Medical Devices
- Report: Chinese State-Sponsored Hacking Group Highly Active
- Votiro Raises $11.5 Million to Prevent File-Borne Threats
- Lumen Technologies Hit by Two Cyberattacks
- Leaked Documents Detail Russia’s Cyberwarfare Tools, Including for OT Attacks
- Mandiant Investigating 3CX Hack as Evidence Shows Attackers Had Access for Months
- Severe Azure Vulnerability Led to Unauthenticated Remote Code Execution
