News Insights: ElasticSearch server exposed the personal data of over 57 million US citizens | ZDNet

News Insights:

Michael Magrath, Director, Global Regulations & Standards, OneSpan, Inc.

“The treasure trove of personally identifiable data on the “Legitimate Web” and the Dark Web just continues to grow enabling fraudsters and steal identities or create new, synthetic identities using a combination of real and made-up information, or entirely fictitious information.  For example, the personal obtained in the one breach could be crossed referenced with data obtained from another breach and other widely publicized private sector breaches.  Having the databases in the same place makes things even easier for the bad guys.

“Cyberattacks will continue and it is imperative that public and private sector organizations not only deploy the latest in authentication and risk based fraud detection technologies in their organizations, but also making sure all third party partners have equal cybersecurity measures in place.”

Tom Garrubba, Sr. Director, Shared Assessments: 

“This is of course a major data breach and, at the root of it, appears to have been a user error (i.e., “misconfiguration of the Elasticsearch instances” allowing public access to the data without authentication). We cannot stress enough of the importance of established checks and balances, segregation of duties, etc., to be defined in procedures and followed with appropriate sign-offs by management.  With an estimated number of affected citizens to be almost 83 million it appears the hackers struck a gold mine. The only hope left here is that there are some iron pyrite – or “fool’s gold” records (meaning – old and no longer usable) – mixed in with the gold of actual current individual records.”