Due to the fact that they left an unprotected RSYNC server with more than 150TB of files accessible, the official Chinese subsidiary of the Japanese watchmaker Citizen has been compromised.
Additionally, the system had files with plain text passwords, usernames, and emails recorded in them.unencrypted, csv-formatted files that are accessible without a password.
The majority of the data on the RSYNC seems to be made up of email inboxes and all associated information, such as Sent, Trash, Inbox, etc.
Other Citizen-owned and -controlled small brands that were impacted by the leak included Vagary.cn, Bulova.com.cn, and several others.
Source: https://www.databreaches.net/china-citizen-watch-finally-secures-150tb-of-leaking-data/
TPRM report: https://scoringcyber.rankiteo.com/company/citizen-watch
"id": "cit258523",
"linkid": "citizen-watch",
"type": "Data Leak",
"date": "12/2019",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'industry': 'Watchmaking',
'location': 'China',
'name': 'Citizen',
'type': 'Company'},
{'industry': 'Watchmaking',
'location': 'China',
'name': 'Vagary.cn',
'type': 'Brand'},
{'industry': 'Watchmaking',
'location': 'China',
'name': 'Bulova.com.cn',
'type': 'Brand'}],
'attack_vector': 'Unprotected RSYNC Server',
'data_breach': {'data_encryption': 'None',
'file_types_exposed': ['CSV'],
'personally_identifiable_information': ['Emails',
'Usernames',
'Passwords'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Emails',
'Usernames',
'Passwords']},
'description': 'The official Chinese subsidiary of the Japanese watchmaker '
'Citizen has been compromised due to an unprotected RSYNC '
'server with more than 150TB of files accessible. The system '
'had files with plain text passwords, usernames, and emails '
'recorded in them, unencrypted, csv-formatted files that are '
'accessible without a password. The majority of the data on '
'the RSYNC seems to be made up of email inboxes and all '
'associated information, such as Sent, Trash, Inbox, etc. '
'Other Citizen-owned and -controlled small brands that were '
'impacted by the leak included Vagary.cn, Bulova.com.cn, and '
'several others.',
'impact': {'data_compromised': ['Emails', 'Usernames', 'Passwords'],
'systems_affected': ['RSYNC Server']},
'initial_access_broker': {'entry_point': 'Unprotected RSYNC Server'},
'post_incident_analysis': {'root_causes': 'Unprotected RSYNC Server'},
'title': 'Data Leak at Chinese Subsidiary of Citizen Watchmaker',
'type': 'Data Leak',
'vulnerability_exploited': 'Unprotected RSYNC Server'}