Security Experts:

Connect with us

Hi, what are you looking for?


Cloud Security

UK Printing Company Exposed Military Documents

Cybersecurity researchers say UK-based document printing and binding company Doxzoo exposed hundreds of gigabytes of information, including documents related to the US and British military, by leaving an AWS S3 bucket unprotected.

Cybersecurity researchers say UK-based document printing and binding company Doxzoo exposed hundreds of gigabytes of information, including documents related to the US and British military, by leaving an AWS S3 bucket unprotected.

vpnMentor researchers claim they have discovered 343GB worth of files on an AWS server belonging to Doxzoo. They say the company was notified on January 26, but it never responded and the leak was only addressed on February 11, nearly a week after AWS was contacted.

According to vpnMentor, the unprotected server stored more than 270,000 records, and the incident could impact over 100,000 users. The exposed data included names, addresses, email addresses, passport scans, partial payment information, order details, copyrighted publications (e.g. books, screenplays, TV show scripts), teacher’s guides, certifications and diplomas, medical documents, floor plans, personal photos, and documents that users likely paid for, such as university course materials and diet and exercise plans.

Internal US and UK military documents were also exposed, including classified documents. In addition to the UK and the US, some of the files appeared to belong to individuals in India, Nigeria and Sri Lanka.

“The data leak includes print jobs for many high-profile clientele, including elite universities, US and UK military branches, Fortune 500 companies, and many, many more,” vpnMentor said in a blog post. “On their website, Doxzoo boasts ISO accreditation for, among other things, security, and prides themselves on keeping their customers’ documents in ‘safe hands.’”

vpnMentor added, “The items contained this leak often hold private and/or confidential information within. The promise of secure facilities and systems are key selling points for clients such as the military, and the breach of that guarantee is not only a failure in service, but also potentially holds a security risk along with it.”

SecurityWeek has reached out to Doxzoo for comment, and while the company has confirmed receiving our email, it has yet to respond.

vpnMentor has identified a significant number of unprotected databases over the past year. The company revealed last week that it recently discovered over 500,000 sensitive legal and financial documents exposed by two connected financial services companies.

Related: E-Commerce Company Gearbest Leaked User Information

Related: Millions of Unencrypted Fingerprint and Facial Biometrics Found on Unsecured Database

Related: Unprotected Database Stored Information on 80 Million U.S. Households

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Cloud Security

Microsoft and Proofpoint are warning organizations that use cloud services about a recent consent phishing attack that abused Microsoft’s ‘verified publisher’ status.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...