Relating to their respective HR departments, the compromised files exposed detailed sensitive information belonging to the firms, along with 1,000s of British professionals. Had this database been discovered by criminal hackers, there could have been serious consequences for the security and privacy of those exposed.
Timeline of Discovery and Owner Reaction
Sometimes, the extent of a data breach and the owner of the data are obvious, and the issue quickly resolved. But rare are these times. Most often, we need days of investigation before we understand what’s at stake or who’s leaking the data. Understanding a breach and its potential impact takes careful attention and time. We work hard to publish accurate and trustworthy reports, ensuring everybody who reads them understands their seriousness. Some affected businesses disregard our research, deny the facts, or play down its impact. So, we need to be thorough and make sure everything we present is correct and true. We traced this back to CHS Consulting, a London-based consulting firm. However, as the company has no website, we cannot confirm their ownership of the database. In the meantime, we also contacted AWS directly and CERT-UK, the country’s Computer Emergency Response Team - responsible for monitoring and handling data security in the UK. By December 19th, the breach had been closed and the database secured.
Date discovered: 9/12/19 Date CERT-UK contacted: 10/12/19 Date of contact with AWS: 17/12/19 Date of Response from AWS: 18/12/19 Date of Action: Approx. 19/12/19
Example of Entries in the Database
The exposed database contained files belonging to many UK-based consultancy firms. These included:
Dynamic Partners (closed in 2019) Eximius Consultants Limited Garraway Consultants (closed in 2014) IQ Consulting Partners Associates Ltd (closed in 2018) Winchester Ltd (closed in 2018)
While most of the exposed data were from 2014-2015, some files go back as far as 2011. Given the nature of the files contained within the database, the information exposed is still relevant and could be used in many ways. The private personal files our team viewed included but were not limited to:
1,000s of passport scans Tax documents Job applications Proofs of address Extensive background checks Criminal records Expenses and benefits forms Paperwork related business taxes and HMRC Scanned contracts with signatures Salary information for a range of roles and positions Emails and private messages A contract for a loan agreement Much more
These documents contained a wide range of Personally Identifiable Information (PII) data for 1,000s of British residents and working professionals. For context, just two files from a single firm contained a full range of PII data:
Full names Addresses Phone numbers Email addresses Dates of birth Genders Job titles & industries National Insurance numbers Tax codes Immigration and Visa statuses Nationalities Salary details Details of individual consultants’ fees Company financial records
Some of these can be seen in the following two snippets (identifying details have been covered):
Had criminal hackers discovered this database, it would have been a goldmine for illicit activities and fraud, with potentially devastating results for those exposed.
Advice from the Experts
“CHS” could have easily avoided this leak if they had taken some basic security measures to protect the database. These include, but are not limited to: Any company can replicate the same steps, no matter its size. For a more in-depth guide on how to protect your business, check out our guide to securing your website and online database from hackers.
Securing an Open S3 Bucket
It’s important to note that open, publicly viewable S3 buckets are not a flaw of AWS. They’re usually the result of an error by the owner of the bucket.
Make the bucket private and add authentication protocols. Follow AWS access and authentication best practices. Add more layers of protection to their S3 bucket to further restrict who can access it from every point of entry.
For The Individual Consultants and Firms Exposed
If you’re a UK-based consultant or consulting firm and are concerned about this breach, contact the CERT-UK to understand what steps are being taken to keep your data safe and ensure it has not been leaked. To learn more about data vulnerabilities in general, read our complete guide to online privacy. It shows you the many ways cybercriminals target internet users, and the steps you can take to stay safe.
How and Why We Discovered the Breach
The vpnMentor research team discovered the breach in “CHS” database as part of a huge web mapping project. Our researchers use port scanning to examine particular IP blocks and test open holes in systems for weaknesses. They examine each hole for data being leaked. When they find a data breach, they use expert techniques to verify the database’s identity. We then alert the company to the breach. If possible, we will also alert those affected by the breach. Our team was able to access this AWS S3 bucket database because it was completely unsecured and unencrypted. The purpose of this web mapping project is to help make the internet safer for all users. These ethics also mean we carry a responsibility to the public. People affected must be aware of a data breach that impacts them also. We also never sell, store, or expose any information we encounter during our security research.
About Us and Previous Reports
vpnMentor is the world’s largest VPN review website. Our research lab is a pro bono service that strives to help the online community defend itself against cyber threats while educating organizations on protecting their users’ data. Our ethical security research team has discovered and disclosed some of the most impactful data leaks in recent years. This has included a huge data leak exposing the biometrics and fingerprints of over 1 million people globally. We also revealed how British video editing platform VEED had compromised the privacy and security of their users. You may also want to read our VPN Leak Report and Data Privacy Stats Report. [Publication date: 31.12.2019]
