An email marketing company left 809 million records exposed online

[InfoSec News <alerts () infosecnews org>]

https://arstechnica.com/information-technology/2019/03/an-email-marketing-company-left-809-million-records-exposed-online/

By Lily Hay Newman
Wired.com
3/9/2019

By this point, you've hopefully gotten the message that your personal data can 
end up exposed in all sorts of unexpected Internet backwaters. But increased 
awareness hasn't slowed the problem. In fact, it's only grown bigger—and more 
confounding.

Last week, security researchers Bob Diachenko and Vinny Troia discovered an 
unprotected, publicly accessible MongoDB database containing 150 gigabytes of 
detailed, plaintext marketing data—including 763 million unique email 
addresses. The pair went public with their findings this week. The trove is not 
only massive but also unusual; it contains data about individual consumers as 
well as what appears to be "business intelligence data," like employee and 
revenue figures from various companies. This diversity may stem from the 
information's source. The database, owned by the "email validation" firm 
Verifications.io, was taken offline the same day Diachenko reported it to the 
company.

While you've likely never heard of them, validators play a crucial role in the 
email marketing industry. They don't send out marketing emails on their own 
behalf or facilitate automated mass email campaigns. Instead, they vet a 
customer's mailing list to ensure that the email addresses in it are valid and 
won't bounce back. Some email marketing firms offer this mechanism in-house. 
But fully verifying that an email address works involves sending a message to 
the address and confirming that it was delivered—essentially spamming people. 
That means evading protections of Internet service providers and platforms like 
Gmail. (There are less invasive ways to validate email addresses, but they have 
a tradeoff of false positives.) Mainstream email marketing firms often 
outsource this work rather than take on the risk of having their infrastructure 
blacklisted by spam filters or lowering their online reputation scores.

"Companies have email lists and want to start emailing them, but they're not 
sure how valid they are," says Troia, who founded the firm Night Lion Security. 
"So they go to a company that will essentially send out spam." Troia 
speculates, but has not confirmed, that the database may be so large and varied 
because it comprises all of Verification.io's customers' data. WIRED was unable 
over the course of several days to contact the company or CEO Vlad Strelkov. On 
Monday, the entire Verifications.io website went offline and has not been 
restored since.

[...]

--
Subscribe to InfoSec News
https://www.infosecnews.org/subscribe-to-infosec-news/
https://twitter.com/infosecnews_