Sitter

Summary

On August 14, independent security researcher Bob Diachenko discovered that Sitter, a popular app for connecting babysitters with parents, accidently exposed the personal information of over 93,000 users. The exposure stemmed from an unsecured MongoDB database that was left open to the internet. This database was publicly accessible and included encrypted passwords for Sitter accounts, partial payment card numbers, home addresses, phone numbers, users’ address book contacts, and the number of children per family. The exposed database was taken offline the same day the company was notified.

Recommendations

Last year, the NJCCIC released several alerts warning members about cyber extortion campaigns that were actively targeting vulnerable MongoDB servers. We recommend that administrators of MongoDB servers review our previous NJCCIC Cyber Alert, audit their security settings, and implement the mitigation strategies provided as soon as possible. We also recommend that users of the Sitter app monitor their personal and financial accounts and report any fraudulent activity as soon as possible.