Wednesday, June 19, 2024

Accenture Data Leak Exposed 137 Gigabytes of Highly Sensitive Data Online Including Master key

One of the Worlds Largest Consulting FirmAccenture” Owned four Biggest cloud-based storage servers left Openly in Public without Securing Tons of Highly sensitive data that could be downloaded without a password by anyone who knew the servers web addresses.

Exposed Cloud Data servers belong to Accenture’s enterprise cloud offering, Accenture Cloud Platform, a “multi-cloud management platform” that is used for Accenture Customers.

These Unsecured Server Hosted on Amazon’s S3 storage service which is holding 137 gigabytes of Customer data has completely left unsecured which Could be affected tons Accenture Cloud Platform Customer Sensitive Data.

Publicly Downloadable  Accenture’s Unsecure Servers contains exposing secret API data, authentication credentials, certificates, decryption keys, customer information, and more data that could have been used to attack both Accenture and its clients.
Also Read : Millions of PornHub Users Hijacked by ad Fraud Malware Infections

All 4 Unsure Server  Contains Sensitive Secret data about the Accenture Cloud Platform, its inner workings, and Accenture clients using the platform which maintains the “awsacp0175,”  as Account Name.

One of the Leaked Bucket Folder named as “Secure Store” Contains Completely Plain Text Document and Highly Sensitive master access key for Accenture’s account which Leads to allow an attacker full control over the company’s encrypted data stored on Amazon’s servers.

According to UpGuard Director of Cyber Risk Research Chris Vickery discovered four Amazon Web Services S3 storage buckets configured for public access, downloadable to anyone who entered the buckets’ web addresses into their internet browser.

Another Bucket Named as “client.jk” holding PlainText passwords and private signing keys were also exposed within these files.

One of 4 Bucket called  “acp-software Contains size of 137 GB largest Sensitive Data including Customers credentials, a collection of nearly 40,000 plaintext passwords and also email information.

Final Bucket  Named as “acp-ssl” Contains Key Stores to provide access to various Accenture environments, such as one titled “Cloud File Store Key,” among a number of private keys, as well as certificates.

“It is possible a malicious actor could have used the exposed keys to impersonate Accenture, dwelling silently within the company’s IT environment to gather more information. The specter of password reuse attacks also looms large, across multiple platforms, websites, and potentially hundreds of clients” UpGuard  Said.


Latest articles

Amtrak Data Breach: Hackers Accessed User’s Email Address

Amtrak notified its customers regarding a significant security breach involving its Amtrak Guest Rewards...

Chrome Security Update – Patch for 6 Vulnerabilities

Google has announced a new update for the Chrome browser, rolling out version 126.0.6478.114/115...

Hackers Weaponize Windows Installer (MSI) Files to Deliver Malware

Cybersecurity researchers have uncovered a sophisticated malware campaign orchestrated by a threat actor group,...

Hackers Using VPNs To Exploit Restrictions & Steal Mobile Data

Hackers are offering "free" mobile data access on Telegram channels by exploiting loopholes in...

New PhaaS Platform Lets Attackers Bypass Two-Factor Authentication

Several phishing campaign kits have been used widely by threat actors in the past....

Stuxnet, The Malware That Propagates To Air-Gapped Networks

Stuxnet, a complex worm discovered in 2010, targeted Supervisory Control and Data Acquisition (SCADA)...

Threat Actors Claiming Breach of AMD Source Code on Hacking Forums

A threat actor named " IntelBroker " claims to have breached AMD in June...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles