MPD FM

MPD FM, a facility management and security company providing services to various UK government departments, left an open instance that exposed employee passports, visas, and other sensitive data.

The exposed files included a trove of severely sensitive information, exposing MDP FM’s employees.

The team urged MPD FM—or anybody else facing the same problem—should immediately revoke public access to the exposed instance and to go back and look for any unauthorized connections in the access logs. Server-side encryption should be used to protect critical items in the Amazon S3 bucket, whoever is in charge of it.

Source: https://securityaffairs.com/149440/security/mpd-fm-data-leak.html

TPRM report: https://scoringcyber.rankiteo.com/company/mpdfmofficial

"id": "mpd41511923",
"linkid": "mpdfmofficial",
"type": "Data Leak",
"date": "08/2023",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Facility Management and Security',
                        'name': 'MPD FM',
                        'type': 'Company'}],
 'attack_vector': 'Open Instance',
 'data_breach': {'data_encryption': 'Recommended',
                 'personally_identifiable_information': ['employee passports',
                                                         'visas'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['employee passports',
                                              'visas',
                                              'other sensitive data']},
 'description': 'MPD FM, a facility management and security company providing '
                'services to various UK government departments, left an open '
                'instance that exposed employee passports, visas, and other '
                'sensitive data.',
 'impact': {'data_compromised': ['employee passports',
                                 'visas',
                                 'other sensitive data'],
            'systems_affected': ['Amazon S3 bucket']},
 'recommendations': ['Revoke public access to the exposed instance',
                     'Check for any unauthorized connections in the access '
                     'logs',
                     'Use server-side encryption to protect critical items in '
                     'the Amazon S3 bucket'],
 'response': {'containment_measures': ['Revoke public access to the exposed '
                                       'instance'],
              'remediation_measures': ['Check for any unauthorized connections '
                                       'in the access logs',
                                       'Use server-side encryption to protect '
                                       'critical items in the Amazon S3 '
                                       'bucket']},
 'title': 'MPD FM Data Exposure Incident',
 'type': 'Data Exposure',
 'vulnerability_exploited': 'Public Access to Amazon S3 Bucket'}