It has been reported that a contractor working for mobile giant Sprint stored hundreds of thousands of cell phone bills of AT&T, Verizon and T-Mobile subscribers on an unprotected cloud server. The AWS storage bucket had more than 261,300 documents, the vast majority of which were phone bills belonging to cell subscribers dating as far back as 2015. It was not protected with a password, allowing anyone to access the data inside. It’s not known how long the bucket was exposed.
Experts Comments
December 07, 2019
If American consumers knew how careless third parties are with their data, they would – or should – be shocked and angry.
Presumably, this is either a sales or marketing contractor, hired to switch-sell customers from competitors, or a reseller working on cross-selling campaigns. A reseller would have access to multiple telcos’ subscribers.
The open nature of the database also supports the marketing/sales angle, giving a wide number of sales reps ready access to the data. Presumably,.....Read More
Like(
December 05, 2019
We’ve seen this same pattern of carelessness over and over.
Far too many people with access to sensitive data can far too easily upload it to AWS or other cloud services, without ensuring basic security.
Organizations need to establish much stronger controls on who can set up and access cloud storage. The bar also needs to be much higher for the cloud providers. AWS and others like to wash their hands of responsibility for customer data saying they have a “shared security model.” But.....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Jonathan Deveaux, Head of Enterprise Data Protection, provides expert commentary at @Information Security Buzz.
"A more effective approach is to think ‘security first’. ..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/sprint-contractor-left-aws-bucket-containing-thousands-of-mobile-phone-bills-exposed
Facebook Message
@Jonathan Deveaux, Head of Enterprise Data Protection, provides expert commentary at @Information Security Buzz.
"A more effective approach is to think ‘security first’. ..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/sprint-contractor-left-aws-bucket-containing-thousands-of-mobile-phone-bills-exposed