<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

Aliznet exposed database leaks data on 2.5 million Yves Rocher customers

down-arrow

Personal information on customers of French retail consultancy Aliznet were exposed through an unprotected Elasticsearch server.

“The most sensitive leaked data involves [2.5 million Canadian] customers of Aliznet’s client Yves Rocher, an international cosmetics and beauty brand,” according to a blog post by vpnMentor, whose research team led by Noam Rotem and Ran Locar discovered the breach. The information exposed included “customers’ full personally identifiable information (PII) were exposed, along with detailed records of their orders.”

The researchers said the records “revealed something potentially sensitive called an FID number for each customer” that might be tied to shipping or taxes as well as unique customer IDs assigned to individuals.

“Managing the extensive supply chains that global enterprises rely on today can be a cumbersome process, especially with legacy GRC tools or spreadsheets,” said George Wrenn, CEO and Founder of CyberSaint Security. “From a purchaser perspective, businesses need to be aware and increasingly diligent when it comes to sourcing a vendor, especially when dealing with the sensitive information that we see in this case.”

Researchers also discovered another serious vulnerability in the exposed Elasticsearch server that allowed them “to access the API interface for an application created by Aliznet for Yves Rocher” and intended for use by the company’s employees, they wrote. “After examining the interface, our researchers believe that it would be possible for someone to easily log in to the system using an employee ID” that the Aliznet leak exposed.

“For companies such as Yves Rocher who contracted with Aliznet, it is a tough situation, because you put trust in your third-party contractors to create a secure application that can deliver you results,” said Lecio DePaula, data privacy director at KnowBe4, who noted that the Aliznet breach is just one more example of the potential “catastrophic results” of a misconfiguration or error. “This situation highlights why it is extremely important to have a third-party information security/privacy risk management program that is able to perform due diligence on software or services that an organization is developing or has developed, especially if it will be housing customer data.”

Since the breach crossed international borders, it could present a privacy challenge for Aliznet and Yves Rocher. “Since the impacted consumers were Canadian, this can have far reaching impacts for Yves Rocher and Aliznet due to data protection regulations such as PIPEDA and other Canadian provincial privacy laws,” said DePaula. “These laws have mandatory breach reporting requirements and organizations are now vulnerable to high fines under the regulation.”

This post originally appeared on SC Media - read it here

You may also like

Groundbreaking Executive Dashboard ...
on February 13, 2023

BOSTON--(BUSINESS WIRE)--CyberSaint, the leader in cyber risk management, today announced the release of its Executive Dashboard. CyberSaint is first-to-market with this new ...

CyberSaint STRONGER 2023 ...
on February 2, 2023

BOSTON--(BUSINESS WIRE)--CyberSaint, the leader in cyber risk management, today announced that the company is seeking speaker submissions for its virtual STRONGER conference, set ...

CyberSaint Partners With and ...
on October 5, 2022

BOSTON--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, today announced its CyberStrong platform is now Powered by Snowflake. ...

Booz Allen Hamilton and CyberSaint ...
on September 7, 2022

MCLEAN, Va. & BOSTON--(BUSINESS WIRE)--Booz Allen Hamilton (NYSE: BAH) and CyberSaint today announced a strategic partnership that aligns Booz Allen’s world-class ...

CyberSaint Continues to Support ...
on July 6, 2022

BOSTON--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, announced the addition of CMMC 2.0, allowing customers to adopt the ...

CyberSaint Makes FAIR Model ...
on June 28, 2022

BOSTON--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, announced the addition of the FAIR (Factor Analysis of Information ...