V Shred

Summary

An unsecured AWS S3 bucket belonging to an online fitness company, V Shred, was discovered by vpnMentor researchers. The publicly accessible bucket contained approximately 1.3 million individual files, including three CSV files that stored various forms of personally identifiable information (PII), as well as sensitive photos from as recently as May 2020. The number of affected individuals exceeds 99,000 and includes both customers and trainers. Breached data includes full name, email, social media account information, phone numbers, username and password, Social Security number, date of birth, home address, health conditions, gender, and citizenship status. Though the company originally denied PII exposure, most of the files containing PII have been removed; however, the S3 bucket remains publicly accessible.  V Shred patrons are urged to take proactive measures to safeguard themselves against cyber-attacks, such as phishing attempts and identity theft.