‘Huge’ data leak exposes British consultancy firms and thousands of consultants

Leaky S3 buckets held sensitive information including passport scans, personal details and financial documents

Leaky servers exposed a wealth of personal and financial data held by British consultancy firms as well as thousands of professionals, ranging from expenses forms to personal names and addresses.

Thousands of sensitive files stored on an Amazon Web Services (AWS) S3 bucket had been exposed for an indeterminate amount of time after a database was found to be completely unsecured and unencrypted.

The compromised files related to the respective HR departments of a host of consultancy firms, as well as thousands of workers whose data was held by these departments. 

Most of the exposed data dates back to the 2014/15 financial year, with some files even going back to 2011, although researchers with vpnMentor, who discovered the leaky database, insist the information exposed is still pertinent to cyber criminals. 

“Given the nature of the files contained within the database, the information exposed is still relevant and could be used in many ways,” the researchers said.

“Had criminal hackers discovered this database, it would have been a goldmine for illicit activities and fraud, with potentially devastating results for those exposed.”

The open S3 bucket was discovered on 9 December 2019 and shut down ten days later after AWS responded to the researchers. 

The documents include thousands of passport scans, for instance, tax documents, background checks, paperwork relating to business taxes, scanned contracts with signatures, as well as emails and private messages.

This is on top of a treasure trove of personally identifiable information such as full names, addresses, phone numbers, and email addresses, as well as immigration statuses, salary details and details of individual consultants’ fees.

Having identified the database owner as just ‘CHS’, the researchers traced this back to CHS Consulting, a London-based consultancy firm. However, the researchers couldn’t completely verify the ownership of the database because this company has no website.

The companies whose files were exposed include, but are not limited to, Dynamic Partners, Eximius Consultants Limited, Garraway Consultants, IQ Consulting, Partners Associates Ltd, Winchester Ltd, researchers with vpnMentor have claimed. A handful of these firms have been dissolved.

Related Resource

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

How to manage security risk and compliance - whitepaperDownload now

vpnMentor discovered the leak as part of a wider web-mapping project, in which port scanning is used to examine IP addresses and test open holes in systems for any potential weaknesses.

“Our team was able to access this AWS S3 bucket database because it was completely unsecured and unencrypted,” the researchers added. “The purpose of this web mapping project is to help make the internet safer for all users.

“As ethical hackers, we’re obliged to inform a company when we discover flaws in their online security. 

“As we couldn’t reach out to the owner directly, we reached out to both the NCSC and Amazon, to let them know about the vulnerability but also to have them help us secure the data.”

The exposure of thousands of consultancy-related files is one of the first major data incidents of 2020, although it follows several similar leaks late last year. 

The same team of researchers, for example, in December 2019 found a trove of millions of text messages leaked through an exposed Microsoft Azure server owned by the US-based communications firm TrueDialog. 

Highly sensitive data belonging to the US Department for Homeland Security (DHS) and the US military to the tune 179GB was also leaked through an unsecured AWS S3 bucket, discovered in September and closed on 2 October 2019.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Security best practices for PostgreSQL

Securing data with PostgreSQL

Download now

Transform your MSP business into a money-making machine

Benefits and challenges of a recurring revenue model

Download now

The care and feeding of cloud

How to support cloud infrastructure post-migration

Watch now

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
Data belonging to 500 million LinkedIn users found for sale on hacker marketplace
hacking

Data belonging to 500 million LinkedIn users found for sale on hacker marketplace

8 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021