Original Release Date: 9/10/2020
Digital Point, one of the largest webmaster marketplaces, exposed over 62 million records of roughly 850,000 users due to an unsecure ElasticSearch database. Revealed data includes usernames, internal user identification numbers, internal records, and user posts. The exposure of this data may allow threat actors to conduct future attacks such as domain hijacking, ransomware, and phishing. Additionally, Meow Bot , a large-scale ElasticSearch bot that searches for unprotected databases and deletes all data leaving the word “meow” followed by random numbers in place of its contents, was discovered just prior to disclosure. Access to the database was restricted within hours of notification on July 1, 2020. Website administrators are urged to enable multi-factor authentication and use strong, unique passwords to avoid victimization.