Cybersecurity researchers say UK-based document printing and binding company Doxzoo exposed hundreds of gigabytes of information, including documents related to the US and British military, by leaving an AWS S3 bucket unprotected.
vpnMentor researchers claim they have discovered 343GB worth of files on an AWS server belonging to Doxzoo. They say the company was notified on January 26, but it never responded and the leak was only addressed on February 11, nearly a week after AWS was contacted.
According to vpnMentor, the unprotected server stored more than 270,000 records, and the incident could impact over 100,000 users. The exposed data included names, addresses, email addresses, passport scans, partial payment information, order details, copyrighted publications (e.g. books, screenplays, TV show scripts), teacher’s guides, certifications and diplomas, medical documents, floor plans, personal photos, and documents that users likely paid for, such as university course materials and diet and exercise plans.
Internal US and UK military documents were also exposed, including classified documents. In addition to the UK and the US, some of the files appeared to belong to individuals in India, Nigeria and Sri Lanka.
“The data leak includes print jobs for many high-profile clientele, including elite universities, US and UK military branches, Fortune 500 companies, and many, many more,” vpnMentor said in a blog post. “On their website, Doxzoo boasts ISO accreditation for, among other things, security, and prides themselves on keeping their customers’ documents in ‘safe hands.’”
vpnMentor added, “The items contained this leak often hold private and/or confidential information within. The promise of secure facilities and systems are key selling points for clients such as the military, and the breach of that guarantee is not only a failure in service, but also potentially holds a security risk along with it.”
SecurityWeek has reached out to Doxzoo for comment, and while the company has confirmed receiving our email, it has yet to respond.
vpnMentor has identified a significant number of unprotected databases over the past year. The company revealed last week that it recently discovered over 500,000 sensitive legal and financial documents exposed by two connected financial services companies.
Related: E-Commerce Company Gearbest Leaked User Information
Related: Millions of Unencrypted Fingerprint and Facial Biometrics Found on Unsecured Database
Related: Unprotected Database Stored Information on 80 Million U.S. Households
