A misconfigured MongoDB server belonging to Abbyy, an optical character recognition software developer, allowed public access to customer files.
Independent security researcher Bob Diachenko discovered the database on August 19 hosted on the Amazon Web Services (AWS) cloud platform. It was 142GB in size and it allowed access without the need to log in.
The sizeable database included scanned documents of the sensitive kind: contracts, non-disclosure agreements, internal letters, and memos. Included were more than 200,000 files from Abbyy customers who scanned the data and kept it at the ready in the cloud.
"Some collection names like 'documentRecognition,' or 'documentXML' hinted that database would be part of a data recognition company infrastructure," Diachenko writes in a blog post today.
Evidence that the database belonged to Abbyy came from another collection of documents that contained usernames under the form of corporate email addresses, and encrypted passwords.
Diachenko says that two days after his notification, the security team at Abbyy disabled access to the information trove. The duration of the exposure is unclear, but it is not far-fetched to assume that data has already been accessed by unauthorized individuals. Such a finding could be worth a lot of money.
In fact, following the disclosure, Diachenko received the following statement from the company informing him that a data breach had affected one of its customers but declined to disclose the name of the party.
Abbyy's customer portfolio counts high-profile names from various sectors. Volkswagen, Deloitte, PwC, PepsiCo, Sberbank, McDonald's are just a few of Abbyy's clients.
Data exposure and leak incidents involving an insufficiently secured MongoDB server are not new, some of them impacting millions of individuals, and ending in ransom demands.
The most recent incident was reported last week and exposed data of 93,000 users of the popular app Sitter, which connects babysitters with parents.