Chinese e-commerce giant Gearbest has exposed information and orders of millions of its customers through an unsecured Elasticsearch server.
It was found the server was not protected with a password and anyone could access it and search the data.
The data exposed includes Customers’ name, address, date of birth, phone number, email address, IP address, national ID and passport information, account passwords and also payment and order related data.
This data could allow hackers to easily steal Gearbest’s customers’ identities by cross-referencing with other databases.
Source: https://www.helpnetsecurity.com/2019/03/15/gearbest-data-exposure/
TPRM report: https://scoringcyber.rankiteo.com/company/gearbest
"id": "gea55412323",
"linkid": "gearbest",
"type": "Data Leak",
"date": "03/2019",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Millions',
'industry': 'Retail',
'location': 'China',
'name': 'Gearbest',
'type': 'E-commerce'}],
'attack_vector': 'Unsecured Elasticsearch Server',
'data_breach': {'number_of_records_exposed': 'Millions',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Information',
'Payment Information',
'Order Information']},
'description': 'Chinese e-commerce giant Gearbest has exposed information and '
'orders of millions of its customers through an unsecured '
'Elasticsearch server.',
'impact': {'data_compromised': ['Customers’ name',
'address',
'date of birth',
'phone number',
'email address',
'IP address',
'national ID',
'passport information',
'account passwords',
'payment and order related data'],
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'title': 'Gearbest Data Breach',
'type': 'Data Breach',
'vulnerability_exploited': 'Lack of password protection'}