Gather ’round and let us reveal a tale that will send shivers down your spine.
Picture this: In the dark cyber realm, a shadowy figure stumbles upon a treasure trove of secrets, unguarded and exposed. A 2.2TB database left wide open, filled with the personal information of over 100 million Americans. This was not just any ordinary find; it was a Pandora’s box of digital horrors.
This vast database, belonging to the background check company MC2 Data, held the essence of individuals’ lives—names, addresses, phone numbers, legal records, and employment histories. The leak impacted nearly one-third of the U.S. population due to a simple error: the database was unprotected without a password.
Cybercriminals rejoiced, finding a goldmine of information ready for exploitation. Imagine the social engineering attacks possible with such details. Social engineering attacks are manipulative tactics used by cybercriminals to deceive individuals into divulging confidential information or performing actions that compromise security. The data of PrivateRecords subscribers and the individuals they had compiled information on were laid bare for such malicious actors.
Remember the lessons this tale imparts. In the age of digital wonders, even the smallest oversight can unleash nightmares upon millions. Stay vigilant, guard your secrets well, and let this story serve as a cautionary tale for all.
For a deeper dive into this chilling narrative and its far-reaching implications, Clyde Williamson, Senior Product Security Architect at Protegrity, discusses the importance of data protection and privacy:
“Looking into their background, MC2 Data owns and operates several websites like PrivateRecords.net that have access to 12 billion public records from thousands of scraped online sources. This information, taken and compiled without any knowledge or consent of those involved, is then used to create background reports. Even more concerning, MC2 Data didn’t even put data security or bare-minimum password protection to this information. So not only are there millions of Americans whose data was scraped and put together without their permission, but now it’s all out there waiting to be picked up by anyone who wants it.
Companies like MC2 Data operate this way so they don’t have to receive personal data directly from individuals. While these types of services are often used by potential employers or loan departments, that’s not the case 100% of the time. Anyone could be using these types of services for any purpose imaginable. Unfortunately, this breach likely impacts both those who subscribed to this service and the people whose data was compiled without their consent.
These background checks don’t just include contact information or address history, either. Instead, we’re looking at deeply personal information such as an individual’s social media profiles, family members, marital and divorce status, and much more. This breach goes beyond business checks and lands squarely as prime social engineering attack fodder for cybercriminals.
In their hands, this type of information can easily be used to scam unsuspecting parents, siblings, friends and other people close to you into sending threat actors their whole life savings on your behalf. MC2 Data did the hard part for such criminals by amassing, storing, and then failing to protect this horde of public information – In fact, they left the door wide open for them to waltz in and take it freely and neatly.
Regardless of whether this was an accidental move on MC2 Data’s part, or at worst a deliberate act of negligence, this incident highlights how poorly organizations understand data security despite having the means to access such vast amount of sensitive data. This failure to secure even basic authorized access is frankly alarming and highlights the inadequacy of U.S. laws in handling citizens’ data, which are not equipped for the challenges of the 21st century.
The focus must shift from merely complying with outdated regulations to embracing the true spirit of data security, because no organization is a data Fort Knox. Our regulations need to value transparency and data de-identification with true data protection strategies like encryption and tokenization, which ensure even when data is stolen it’s useless to threat actors looking to abuse it.”
