- Researchers found an unprotected database containing sensitive customer data
- It belongs to APIsec, a company specializing in API security testing
- Affected customers were allegedly notified
APIsec, a company specializing in proactive, automated, and continuous API security testing, may have inadvertently leaked sensitive customer data online, experts have said.
The discovery was first made by cybersecurity researchers UpGuard, and later confirmed by the company itself.
The data was being stored in an internet-connected database that wasn’t password-protected, and has apparently remained like that for “several” days before being locked down as soon as UpGuard notified APIsec.
Notifying affected customers
Since the company tracks its clients’ APIs for security weaknesses, most of the data was generated by its own products.
Some of the data dated back to 2018, and included both customer employees and users’ names, email addresses, as well as API security posture information. Since this data included things like whether or not 2FA was activated, it is the type of information that can prove quite useful for a threat actor.
APIsec reportedly first tried to downplay the importance of the incident, saying the database held “test data”, that it wasn’t the company’s production database, and that it didn’t hold customer data, but changed its stance when presented with information suggesting otherwise.
Apparently, UpGuard found evidence that the database also held data from real-world corporate customers, including names and emails, and scan results.
When TechCrunch shared the information with APIsec, it later said that it notified customers whose personal information was found in the data. However, it didn’t want to say how many people were affected, nor did it want to share a copy of the breach notification letter.
Unprotected databases remain one of the key causes of sensitive data leaks. Many organizations use the cloud to host information about their employees, clients, or customers, forgetting the fact that cloud hosting works on a shared responsibility model.
