CRM company left millions of files unprotected, says researcher

Another example of what looks like an employee-generated configuration error exposed three million corporate and customer records of a software company to anyone who could find it on the internet.

According to security researcher Jeremiah Fowler, who discovered the database in August, the company is Really Simple Systems — now called Spotler CRM — a U.K. supplier of customer relationship management (CRM) solutions.

He outlined the discovery Wednesday in a blog for vpnMentor, after giving the company time to find and block access to the database.

On the day Fowler notified the company, one folder belonging to a managed educational platform that provides educational and school management services was removed from public access. However, he added, other folders remained accessible for several days before being restricted.

“The database contained hundreds of folders, and most of them appeared to hold documents related to individual companies and their customers,” he said. “Other folders contained shared images, invoices, templates, and other Really Simple Systems internal records.

“Among other documents, the database contained 2,565,602 .dat files, 50,242 image files, and 101,290 invoices that may expose the customer’s name, address, and CRM plan details. There were many other types of file extensions and these represent the top three most common files in the database.”

“In a limited sampling, I saw an incredibly wide range of documents, which belonged to different kinds of organizations, from small businesses to global well-known organizations. I saw information from companies and customers located in the U.S.A, U.K., Australia, multiple EU countries, and more.

“Notably, a vast majority of these records could be considered highly sensitive, as they exposed personally identifiable information (PII). Some of the most potentially sensitive files I saw were medical records, identification documents, real estate contracts, credit reports, legal documents, tax documents, non-disclosure agreements, and even disability claims, all of which showed SSN and tax identification numbers.

“One of the client folders contained a large collection of child psychological examination documents marked as confidential. I also saw plenty of internal document templates that are believed to be associated with Really Simple Systems and their users that included emails, billing data and invoices, service agreements, and more.”

With over 100,000 exposed invoices, the incident could have shown anyone — including a criminal — who Really Simple System’s customers are, how much they are spending, their storage plans, account numbers, and other information that was not intended to be public, Fowler noted. This could, he said, potentially allow criminals to manipulate or send fraudulent invoices to the customers of the company.

Misconfigurations cover a wide range of issues, but note this: According to the Open Worldwide Application Security Project (OWASP), this year, broken access control is number one on its top 10 list of web application security risks. Fourth is insecure application design, and sixth is security misconfiguration.

Fowler said it is crucial for every IT department to implement robust cybersecurity measures, such as encryption, access controls, regular security audits, employee training, intrusion detection systems, and incident response plans.