Exactis said to have exposed data of 340M people, more than Equifax breach. Similar to many recently-disclosed breaches, the information what left on a publicly accessible server… no need to beat that dead horse, but the 2 terabytes worth of data appears to go into excruciating detail for each individual listed, including phone numbers, home addresses, email addresses, and other highly personal characteristics for every name. The categories range from interests and habits to the number, age, and gender of the person’s children. Below is security experts comments highlighting the importance of data protection.
Anurag Kahol, CTO at Bitglass:
Exposing roughly 340 million records – or a database of nearly 2 TB – to the public internet is a significant offense by the organization and one that we’ve seen dozens of times in the past year, yet it is unlikely that we’ll see anything change unless organizations take the initiative in protecting corporate data.
Regulations like GDPR have already compelled many to reassess their security postures, to deploy technologies that mitigate risk of data loss, and to limit transfer of sensitive consumer data to high-risk third parties.”
Ruchika Mishra, Director Products and Solutions at Balbix:
It could be a while before the real impact of this breach is truly known, and as we’ve become accustomed to, the extent of this breach could be much worse than what was initially reported. It will require a fundamental shift in the way organizations perceive their risk, but given the skills shortage and the exponential growth in attack tactics, the only chance IT security teams and service providers will have is by re-wiring the way they think about risk and putting their full effort into understanding how to avoid breaches of information, IP or services that mean the most to their business.
The constantly changing device demographics and increasing sophistication in cyberattack techniques, including an increase in recent multi-pronged attacks require a perspective change in an organization’s cybersecurity strategy to focus on a more proactive approach to security by understanding the value of an asset, endpoint, database or person based on its impact to the business’ bottom line and avoiding getting breached in the first place.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.