Unsecured Elasticsearch Server

Summary

Researchers discovered an unsecured Elasticsearch server containing 1.2 billion unique records. The breached data contains home and mobile phone numbers, personal and business email addresses, and accumulated profile information with associated URLs from several social media sites. Researchers believe the data may have originated from either Oxydata or People Data Labs (PDL); however, the server resides on Google Cloud and ownership could not be determined. The FBI was notified upon discovery, took the server offline, and will be conducting an investigation on the exposure. Further information can be found in the Data Viper article.