Tuesday, February 11, 2025
HomeData BreachVOIP Service Provider Exposes 350M Customer Records

VOIP Service Provider Exposes 350M Customer Records

Published on

SIEM as a Service

Follow Us on Google News

A database of over 350 million customer records exposed from unsecured Elasticsearch cluster belonging to voice over-internet-protocol company Broadvoice.

The database was uncovered by security researcher Bob Diachenko, on October 1. He observed that the unprotected Elasticsearch cluster contained several information found unprotected.

What are the Data Exposed

An amount of 350 million customer records exposed through that includes caller names, phone numbers, locations.

One of the databases found to contain hundreds of thousands of voicemails, other sensitive information such as medical prescriptions and financial loans.

The database was discovered by Diachenko on October 1, 2020, and the same it was disclosed to Broadvoice and it has been secured by October 4th.

Following are the full list of data exposed

  • Full caller name
  • Caller identification number
  • Phone number
  • date of birth
  • State
  • City
  • Caller name (full name, business name, or a generic name such as “wireless caller”)
  • Caller phone number
  • A name or identifier for the voice mailbox (for example, a first name or general label, such as “clinical staff” or “appointments”)
  • Internal identifiers

When the data exposed to the public, there be a choice for unauthorized parties access, if attackers access the data they use them to launch targeted attacks.

Broadvoice said that ” we take data privacy and security seriously. We learned that on October 1st, a security researcher was able to access a subset of b-hive data. The data had been stored in an inadvertently unsecured storage service Sept. 28th and was secured Oct. 2nd”.

Broadvoice is a privately owned company that provides services like telephone services, UCaaS, SIP Trunking, Network, and Security, along with Virtual Call Center solutions to enable business customers to transmit/ receive voice and video communications via a broadband Internet connection or cellular phone.

Regardless of the size of the organization, anyone who uses cloud technology is subject to the risk of unintentional exposure. 

Amazon published an article on how to secure the files in my Amazon S3 bucket details the access restrictions.

Also Read

Reddit Data Breach – Hackers Stolen Users’ Email Address and Credentials

10 Million Customers Personal Records Leaked in Dixons Carphone Massive Data Breach

157 GB of Sensitive Data From Top Manufacturer Including Ford, Toyota, GM, Tesla Exposed Online

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

FinStealer Malware Targets Leading Indian Bank’s Mobile Users, Stealing Login Credentials

A new cybersecurity threat has emerged, targeting customers of a prominent Indian bank through...

Evil Crow RF Tool Transforms Smartphones into Powerful RF Hacking Devices

Innovative tools are continually appearing to enhance the capabilities of professionals and enthusiasts alike.One...

Massive Facebook Phishing Attack Targets Hundreds of Companies for Credential Theft

A newly discovered phishing campaign targeting Facebook users has been identified by researchers at...

Researchers Found North Korean Hackers Advanced Tactics, techniques, and procedures

Recent research has highlighted the increasingly sophisticated tactics, techniques, and procedures (TTPs) employed by...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

OpenAI Data Breach – Threat Actor Allegedly Claims 20 Million Logins for Sale

Threat actors from dark web forums claim to have stolen and leaked 20 million...

Globe Life Ransomware Attack Exposes Personal and Health Data of 850,000+ Users

Globe Life Inc., a prominent insurance provider, has confirmed a major data breach that...

BeyondTrust Zero-Day Breach – 17 SaaS Customers API Key Compromised

BeyondTrust, a leading provider of identity and access management solutions, disclosed a zero-day breach...