Walmart Partner Exposed Personal Data Of 1.3 Million US And Canadian Shoppers

The personal data of over 1.3 million people across the United States and Canada were publicly exposed online by Walmart’s jewelry partner. The data was discovered by security experts at cybersecurity firm Kromtech, who found it stored in a publicly accessible Amazon S3 bucket.

Researchers first assumed the exposed Amazon web server belonged to Walmart, since the storage bucket was named “walmartsql.” However, they later uncovered the database actually belonged to a Chicago-based firm called MBM Company Inc., which primarily operates under the name Limogés Jewelry.

According to Kromtech researchers, the database was left exposed online since Jan. 13, 2018, and included names, addresses, zip codes, phone numbers, email addresses, plaintext passwords, for shopping accounts of 1,314,193 people.

It also contained numerous records for retailers other than Walmart. Over the years, Limogés Jewelry has done business with retailers such as Amazon, Overstock, Sears, Kmart, and Target, among others.

Kromtech researchers also found internal MBM mailing lists, payment details, promo codes, item orders, as well as encrypted credit card details. The records exposed dated as far back as 2000 and extended to early 2018. Researchers believe this may have been MBM Company’s main customer database.

“The negligence of leaving a storage bucket open to the public after the publication of so many other vulnerable Amazon s3 buckets is simple ignorance,” Kromtech chief communication officer Bob Diachenko wrote in a blog. “Furthermore, to store an unprotected database file containing sensitive customer data in it anywhere directly online is astonishing, and it is completely unfathomable that any company store passwords in plain text instead of encrypting them.”

The passwords exposed indicate people still use extremely simple passwords. According to Kromtech researchers, the passwords were so simple even if they had been encrypted, a password-cracking machine using just regular words could have cracked them in “mere seconds.”

Fortunately, shortly after Kromtech researchers contacted Walmart, the publicly accessible database was “quietly” secured by Walmart, Diachenko told International Business Times. He added in such cases, Kromtech researchers have previously come across hackers having accessed such unsecured databases to demand ransom from the owners. In this case, although Kromtech researchers found no evidence of ransom notes, “that does not mean that nobody accessed the data,” Diachenko told IBT.

It is still unclear as to why or how the Amazon S3 bucket containing such important information was left exposed. IBT reached out to Walmart and Limogés Jewelry for further information about the breach and is awaiting a response.