<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

Aliznet exposed database leaks data on 2.5 million Yves Rocher customers

down-arrow

Personal information on customers of French retail consultancy Aliznet were exposed through an unprotected Elasticsearch server.

“The most sensitive leaked data involves [2.5 million Canadian] customers of Aliznet’s client Yves Rocher, an international cosmetics and beauty brand,” according to a blog post by vpnMentor, whose research team led by Noam Rotem and Ran Locar discovered the breach. The information exposed included “customers’ full personally identifiable information (PII) were exposed, along with detailed records of their orders.”

The researchers said the records “revealed something potentially sensitive called an FID number for each customer” that might be tied to shipping or taxes as well as unique customer IDs assigned to individuals.

“Managing the extensive supply chains that global enterprises rely on today can be a cumbersome process, especially with legacy GRC tools or spreadsheets,” said George Wrenn, CEO and Founder of CyberSaint Security. “From a purchaser perspective, businesses need to be aware and increasingly diligent when it comes to sourcing a vendor, especially when dealing with the sensitive information that we see in this case.”

Researchers also discovered another serious vulnerability in the exposed Elasticsearch server that allowed them “to access the API interface for an application created by Aliznet for Yves Rocher” and intended for use by the company’s employees, they wrote. “After examining the interface, our researchers believe that it would be possible for someone to easily log in to the system using an employee ID” that the Aliznet leak exposed.

“For companies such as Yves Rocher who contracted with Aliznet, it is a tough situation, because you put trust in your third-party contractors to create a secure application that can deliver you results,” said Lecio DePaula, data privacy director at KnowBe4, who noted that the Aliznet breach is just one more example of the potential “catastrophic results” of a misconfiguration or error. “This situation highlights why it is extremely important to have a third-party information security/privacy risk management program that is able to perform due diligence on software or services that an organization is developing or has developed, especially if it will be housing customer data.”

Since the breach crossed international borders, it could present a privacy challenge for Aliznet and Yves Rocher. “Since the impacted consumers were Canadian, this can have far reaching impacts for Yves Rocher and Aliznet due to data protection regulations such as PIPEDA and other Canadian provincial privacy laws,” said DePaula. “These laws have mandatory breach reporting requirements and organizations are now vulnerable to high fines under the regulation.”

This post originally appeared on SC Media - read it here

You may also like

CRN® Lists CyberSaint in Its 2022 ...
on April 4, 2022

BOSTON--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, has been recognized by CRN®, a brand of The Channel Company, in its ...

Award-Winning Cybersecurity ...
on March 17, 2022

BOSTON--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, today announced that Nicole Dove, award-winning cybersecurity ...

Cybersecurity Governance ...
on March 9, 2022

BOSTON--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, today announced that Kevin Powers, cybersecurity and data privacy law ...

Cybersecurity, IT and Corporate ...
on March 2, 2022

BOSTON--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, today announced that Summer Fowler, cybersecurity, IT, and corporate ...

Technology Industry Veteran Atiq ...
on February 16, 2022

BOSTON--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, today announced that Atiq Raza, cybersecurity and technology industry ...

New CyberBase Platform by ...
on February 15, 2022

BOSTON, February 15, 2022--(BUSINESS WIRE)--CyberSaint, the developer of the leading platform delivering cyber risk automation, today announced that its new CyberBase platform for ...