A database containing 260GB of sensitive personal data from myrocket. co, which provides end-to-end recruitment solutions and HR services to Indian businesses was left publicly accessible on the internet.
The incident affected nearly 200,000 employees and almost nine million job seekers.
The issue was caused by a misconfiguration and the company fixed the issue upon notification.
The exposed data included employees’ names, taxpayer information, personal identification numbers, emails, phone numbers, bank details, parent names, dates of birth, salaries, employee roles, insurance, tax information, work contracts, addresses, and even photocopies of personal documents such as driving licenses or voter IDs.
Source: https://heimdalsecurity.com/blog/data-leaks-how-an-hr-platform-left-employees-private-data-exposed/
TPRM report: https://scoringcyber.rankiteo.com/company/rocket-app
"id": "roc20818123",
"linkid": "rocket-app",
"type": "Data Leak",
"date": "12/2022",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': ['nearly 200,000 employees',
'almost nine million job '
'seekers'],
'industry': 'Recruitment and HR Services',
'location': 'India',
'name': 'MyRocket.co',
'type': 'Company'}],
'attack_vector': 'Misconfiguration',
'data_breach': {'personally_identifiable_information': ['names',
'taxpayer information',
'personal '
'identification '
'numbers',
'emails',
'phone numbers',
'bank details',
'parent names',
'dates of birth',
'salaries',
'employee roles',
'insurance',
'tax information',
'work contracts',
'addresses',
'photocopies of '
'personal documents '
'such as driving '
'licenses or voter '
'IDs'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal data',
'Taxpayer information',
'Employment details',
'Financial information',
'Personal documents']},
'description': 'A database containing 260GB of sensitive personal data from '
'myrocket.co, which provides end-to-end recruitment solutions '
'and HR services to Indian businesses was left publicly '
'accessible on the internet.',
'impact': {'data_compromised': ['employees’ names',
'taxpayer information',
'personal identification numbers',
'emails',
'phone numbers',
'bank details',
'parent names',
'dates of birth',
'salaries',
'employee roles',
'insurance',
'tax information',
'work contracts',
'addresses',
'photocopies of personal documents such as '
'driving licenses or voter IDs']},
'post_incident_analysis': {'corrective_actions': ['Fixed the '
'misconfiguration'],
'root_causes': ['Misconfiguration']},
'response': {'remediation_measures': ['Fixed the misconfiguration']},
'title': 'MyRocket.co Data Exposure Incident',
'type': 'Data Exposure',
'vulnerability_exploited': 'Publicly accessible database'}