14 Sep Gaming hardware giant Razer exposed customer data via misconfigured database
Global gaming hardware manufacturing company Razer leaked the personal information of around 100,000 customers by storing their data in an Elasticsearch cluster that was misconfigured to enable public access, security researcher Bob Diachenko has revealed.
The personal information of around 100,000 Razer customers was stored by the company in a large log chunk within an Elasticsearch cluster. The cluster was indexed by several public search engines as it was misconfigured for public access since 18th August.
According to Diachenko, who is well-known for unearthing publicly-exposed online databases, personal information stored in the log included full names, email addresses, phone numbers, customer internal IDs, order numbers, order details, billing, and shipping addresses.
“The customer records could be used by criminals to launch targeted phishing attacks wherein the scammer poses as Razer or a related company,” Diachenko said, adding that customers should be on the lookout for malicious emails or messages that might encourage them to click on links to fake login pages or download malware onto their device.
“We were made aware by Mr. Volodymyr [Diachenko] of a server misconfiguration that potentially exposed order details, customer, and shipping information. No other sensitive data such as credit card numbers or passwords were exposed,” Razer said after the breach was disclosed by Diachenko.
“The server misconfiguration has been fixed on 9 Sept, prior to the lapse being made public. We would like to thank you, sincerely apologize for the lapse, and have taken all necessary steps to fix the issue as well as to conduct a thorough review of our IT security and systems. We remain committed to ensuring the digital safety and security of all our customers,” the company added.
Commenting on the latest instance of a company exposing customer via a misconfigured online database, Chris DeRamus, VP of Technology, Cloud Security Practice at Rapid7, said to avoid cloud misconfigurations, companies need to immediately shift toward a new model of security that provides continuous controls and enforces secure configurations of cloud services, instead of attempting to do so only after a breach has occurred.
“Organisations need a security solution that provides the automation essential to enforce policy, reduce risk, provide governance, impose compliance, and increase security across a large-scale, hybrid cloud infrastructure. Automation takes the headache out of making cloud infrastructure secure in a shared responsibility world by providing a framework for what organizations should be doing via a continuous, real-time process.
“By leveraging security automation, companies can stay agile and innovate while maintaining the integrity of their technology stacks and applying the unique policies necessary to operate their businesses,” he added.
How can we help?
Here at VaraTech, we offer a broad range of IT support and consultancy services that aim to help small businesses extract maximum value from their IT. From proactive network monitoring/maintenance and hardware leasing to Cloud services, VoIP telephony and much more, we help our clients identify and roll-out the best-fit solutions for their businesses.
We’re cloud computing experts! We can help your business leverage the potential of some of the most empowering Cloud services, such as Microsoft 365. Why not get in touch today, to discover how the flexibility, scalability cost-efficiency, convenience and security of Cloud services can help your business realise its potential.