Tuesday, December 5, 2023

Verizon Partner Exposed Around 14 Million’s of Customer Accounts Sensitive Data Online

Verizon owned as many as 14 Millions of customer’s data exposed online by telephonic software and data firm NICE Systems, a third-party vendor for Verizon due to a misconfiguration in their cloud server.

Recent days many companies are continually suffering massive Data breaches, and cyber threats and attacks are increasing day by day around the world.

Verizon customers personal information has managed in Amazons Web Services S3 bucket that is administrated by NICE Systems engineers.

Verizon using NICE Systems technology in its back-office and call center operations and other related technical operations.

The exposed sensitive information contains customer names, addresses, account details, and account personal identification numbers (PINs) of as many as 14 million US customers.

Apart from this leak, also Exposed Verizon account PIN codes used to verify customers, listed alongside their associated phone numbers.

A Discovered Amazon cloud S3 bucket repository was fully downloadable and configured to allow public access which contains many terabytes of contents could thus be accessed merely by entering the S3 URL.

Accoring to UpGuard report,The repository’s subdomain, “verizon-sftp,” is an indication of the files’ corporate origins. Viewing the repository, there are six folders titled “Jan-2017” through “June-2017,” as well as a number of files formatted with .zip, among them “VoiceSessionFiltered.zip” and “WebMobileContainment.zip.” These files, inaccessible via .zip extraction, could be decompressed once the format was changed to .gzip, another file compression program.

In this discovered folders that show the date that contains each month of data, each of these day folders is a couple dozen or so compressed files which is capable of the store the daily records automatically in respective folders.

After unzipped the files, it revealed a larger amount of text files that contains almost 23GB of data where the folder have composed of voice recognition log files, the records of an individual’s call to a customer support line, including fields like “TimeInQueue” and “TransferToAgent.” Pings to various subdomains of https://voiceportalfh.verizon.com further indicate the voice-activated technology producing this data.

Apart from this many exposed Verizon account contains logs, such as customer names, addresses, and phone numbers, as well as information fields indicating customer satisfaction tracking, such as “frustration level,.”

Exposed data are very sensitive information such as a PIN, CUSTCODE are masked for some of customers data, but not all the accounts confidential information are masked, some of the accounts revealing such details as unmasked “PIN” codes.

“The critical data repository in question was exposed not by the enterprise holding primary responsibility for the information, but by a third-party vendor to the enterprise. It was a publicly accessible AWS S3 bucket owned by third-party vendor NICE Systems that revealed the sensitive personal details of Verizon customers”. UpGaurd said.

Some of Very Recent Data Leaked Online

  1. Famous Cosmetic Company “Tarte” leaked 2 Million Customers Personal Data Online
  2. Fashion Retailer FOREVER 21 Admits Payment Card Security Breach
  3. Accenture Data Leak Exposed 137 Gigabytes of Highly Sensitive Data Online
  4.  Deloitte Hacked by Cyber Criminals and Revealed Client & Employee’s Secret Emails
  5. Leading research and advisory firms Forrester was hacked
  6. Disqus confirms it’s been hacked and more than 17.5 Million Users Details Exposed
  7. Gaming Service R6DB Database deleted By Hackers and held for Ransom
  8. Biggest Hack Ever – Each and Every Single Yahoo Account Was Hacked in 2013
  9. Pizza Hut Hacked – Users Reporting Fraudulent Transactions on their Cards
  10. Hyatt Hotels Data Breach Exposed 41 Hotel Customers Payment Card Information
  11. Verizon Wireless Confidential DataLeaked Accidentally by Its Employee
  12. ABC Company Massive Data Leaked online from Amazon S3 Bucket
  13. Pentagon Data Leak Exposed 1.8 Billion of Social Media Surveillance Data
  14. Uber Data Breach Exposed Personal Information of 57 Million Uber Users
  15. HP Exposed more than 400,000 Customers Sensitive Information Online
  16. Imgur Data Breach Exposed 1.7 Million Users Emails and Passwords by Hackers
  17. Paypal Acquired firm TIO Networks Data Breach that Impacts 1.6 Million Customers


Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles