Estée Lauder

Summary

A security researcher found an exposed database belonging to New York-based cosmetic company Estée Lauder. The unprotected data included an estimated 440 million records comprised of IP and email addresses, audit logs, ports, pathways, storage info, reports and internal documents, as well as CMS (content management system) and middleware logs. Cyber-criminals can use the middleware information – vital software that provides services and capabilities to applications – to canvas the company for future malware attacks. The researcher noted that customer payment data and sensitive employee information were not revealed, and that Estée Lauder secured the database within hours of notification.