About 100,000 customers of Razer, a high-end equipment provider for gamers, have been affected by a data breach incident, says one researcher. Razer sells all kinds of products for video game fans, such as powerful laptops, accessories and even clothing, mentions a report from the ThreatPost website.
The report was prepared by security specialist Bob Diachenko, who detected the mis-configured Elasticsearch implementation where the exposed information was located. Among the data contained in this database are full names of customers, their telephone numbers, email address, order history, among other details.
Diachenko believes that the number of customers affected is close to 100 thousand, although the figure could change as the investigation progresses: “We have not yet determined the number of customers affected, although by the number of emails exposed we believe that the figure exceeds 100 thousand”, mentioned by the expert.
The leak was detected on August 18 and reported a few hours later. Although the company immediately began working to mitigate the incident, some inconveniences in the process affected the work of Razer’s security team.
Despite technical issues, elasticsearch deployment could eventually be secured. At the moment there is no way to know if any threat actor managed to access the compromised information, although researchers warn that such incidents represent the ideal opportunity for threat actors to launch the attack, mainly using phishing and social engineering campaigns.
“Any criminal could use these logs to launch phishing attacks posing as a member of Razer’s team for malicious purposes,” Diachenko says. The expert recommends that potentially affected users stay alert to any email allegedly sent by the company, as it could be a scam or a malicious email with hidden malware.
A Palo Alto Networks report states that incorrect cloud deployment configurations account for about 60% of the data breaches reported annually, so it can be seen that despite being a basic security practice, successful deployment of cloud storage continues to create multiple problems.
Last June, an Amazon Web Services (AWS) bucket exposed on the public Internet leaked the personal information of thousands of Joomla users; in a similar incident, an Elasticsearch server exposed tens of thousands of MacKiev Software logs, in a sample of how often these incidents occur.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.