On August 4th a server showed up on my logs with a total amount of 1.2 billion exposed records between two tables. A lot of the initial entries were basically all null values besides customer type and guid so I didn’t pay much attention to it.
This server kept showing up on my logs over August so at the end of the month I took a better look at it to try and see how much exactly was being exposed in it.
The 1.2 billion records were spread in 2 tables 400+800 million records, the 400 million records seemed to be generated off the bigger table as all emails matched the bigger one.
The records exposed included full name, dob, email, phone number, company name and addresses.
Some stats on the data:
399,043,425 records had at least 3 fields non-null (excluding the guid and cust_type)
2,932,167 email entries - 1,450,248 of them were unique addresses.
3,217 unique gov.ph emails
I could see most of the data belonged to Philippines citizens but I still wasn’t sure who actually owned this so I never ended up sending any emails for this, earlier this week I was gonna take another look at it and saw it wasn’t exposed anymore, according to my logs this stopped being exposed around the 21st of September.
I have an idea of who this might belong to after looking at this again to write this post but, since I’m not sure, I’m not naming any companies.
I attached a picture of the fields exposed on this data and you can check the top 100 email domain counts exposed using this link: https://pastebin.com/fGKXDcz6
#cybersecurity #infosec #dataleak #leak #philippines
