A misconfiguration in a CVS Health cloud database left over a billion records exposed, according to an investigation by WebsitePlanet in cooperation with security researcher Jeremiah Fowler.
The roughly 240GB database was not password protected, meaning anyone who knew where to look could find the records held within.
A total of 1,148,327,940 records belonging to the US health care and pharmaceutical behemoth, which owns CVS Pharmacy and Aetna, were found. The database contained production records that exposed Visitor ID, Session ID, and device information (i.e., iPhone, Android, iPad, etc.).
Worryingly, the files also gave threat actors a clear understanding of configuration settings, where data is stored, and a blueprint of how the logging service operates from the backend.
Researchers also found multiple records of visitors’ search histories, including medications, COVID-19 vaccines, and other CVS products.
"Hypothetically, it could have been possible to match the Session ID with what they searched for or added to the shopping cart during that session and then try to identify the customer using the exposed emails," researchers said.
The investigation also carried out a sampling search query that revealed emails hackers could target in a phishing attack or potentially use to cross-reference other actions.
RELATED RESOURCE
The secure cloud configuration imperative
The central role of cloud security posture management
After discovering the unprotected database on March 21, the researchers immediately sent a responsible disclosure notice to CVS Health. The company restricted public access the same day.
In a statement, CVS Health said, “We were able to reach out to our vendor and they took immediate action to remove the database. Protecting the private information of our customers and our company is a high priority, and it is important to note that the database did not contain any personal information of our customers, members or patients.”
Paul Norris, a senior systems engineer at Tripwire, told ITPro that misconfigurations like these are becoming all too common.
“Exposing sensitive data doesn’t require a sophisticated vulnerability, and the rapid growth of cloud-based data storage has exposed weaknesses in processes that leave data available to anyone. A misconfigured database on an internal network might not be noticed, and if noticed might not go public, but the stakes are higher when your data storage is directly connected to the Internet,” he said.
“Organizations should identify processes for securely configuring all systems, including cloud-based storage, like Elasticsearch and Amazon S3. Once a process is in place, the systems must be monitored for changes to their configurations. These are solvable problems, and tools exist today to help."
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
Capita tells pension provider to 'assume' nearly 500,000 customers' data stolenCapita told the pension provider to “work on the assumption” that data had been stolen
-
Gumtree site code made personal data of users and sellers publicly accessibleNews Anyone could scan the website's HTML code to reveal personal information belonging to users of the popular second-hand classified adverts website
-
Pizza chain exposed 100,000 employees' Social Security numbersNews Former and current staff at California Pizza Kitchen potentially burned by hackers
-
83% of critical infrastructure companies have experienced breaches in the last three yearsNews Survey finds security practices are weak if not non-existent in critical firms
-
Identity Automation launches credential breach monitoring serviceNews New monitoring solution adds to the firm’s flagship RapidIdentity platform
-
Neiman Marcus data breach hits 4.6 million customersNews The breach took place last year, but details have only now come to light
-
Indiana notifies 750,000 after COVID-19 tracing data accessedNews The state is following up to ensure no information was transferred to bad actors
-
Pearson fined $1 million for downplaying severity of 2018 breachNews The SEC found the London-based firm made “misleading statements and omissions” about the intrusion
