CRM company left millions of files unprotected, says researcher

Share post:

Another example of what looks like an employee-generated configuration error exposed three million corporate and customer records of a software company to anyone who could find it on the internet.

According to security researcher Jeremiah Fowler, who discovered the database in August, the company is Really Simple Systems — now called Spotler CRM — a U.K. supplier of customer relationship management (CRM) solutions.

He outlined the discovery Wednesday in a blog for vpnMentor, after giving the company time to find and block access to the database.

On the day Fowler notified the company, one folder belonging to a managed educational platform that provides educational and school management services was removed from public access. However, he added, other folders remained accessible for several days before being restricted.

“The database contained hundreds of folders, and most of them appeared to hold documents related to individual companies and their customers,” he said. “Other folders contained shared images, invoices, templates, and other Really Simple Systems internal records.

“Among other documents, the database contained 2,565,602 .dat files, 50,242 image files, and 101,290 invoices that may expose the customer’s name, address, and CRM plan details. There were many other types of file extensions and these represent the top three most common files in the database.”

“In a limited sampling, I saw an incredibly wide range of documents, which belonged to different kinds of organizations, from small businesses to global well-known organizations. I saw information from companies and customers located in the U.S.A, U.K., Australia, multiple EU countries, and more.

“Notably, a vast majority of these records could be considered highly sensitive, as they exposed personally identifiable information (PII). Some of the most potentially sensitive files I saw were medical records, identification documents, real estate contracts, credit reports, legal documents, tax documents, non-disclosure agreements, and even disability claims, all of which showed SSN and tax identification numbers.

“One of the client folders contained a large collection of child psychological examination documents marked as confidential. I also saw plenty of internal document templates that are believed to be associated with Really Simple Systems and their users that included emails, billing data and invoices, service agreements, and more.”

With over 100,000 exposed invoices, the incident could have shown anyone — including a criminal — who Really Simple System’s customers are, how much they are spending, their storage plans, account numbers, and other information that was not intended to be public, Fowler noted. This could, he said, potentially allow criminals to manipulate or send fraudulent invoices to the customers of the company.

Misconfigurations cover a wide range of issues, but note this: According to the Open Worldwide Application Security Project (OWASP), this year, broken access control is number one on its top 10 list of web application security risks. Fourth is insecure application design, and sixth is security misconfiguration.

Fowler said it is crucial for every IT department to implement robust cybersecurity measures, such as encryption, access controls, regular security audits, employee training, intrusion detection systems, and incident response plans.

The post CRM company left millions of files unprotected, says researcher first appeared on IT World Canada.
Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

Featured Tech Jobs


Related articles

Cyber Security Today, Week in Review for week ending Friday, Feb. 23, 2024

This episode features discussion on the takedown of the LockBit ransomware gang

Breaking news: RCMP facing ‘alarming’ cyber attack

The RCMP is facing a serious cyber attack from an unspecified threat actor. The Mounties told CBC News today that a “breach of this magnitude is alarming.” “The situation is evolving quickly but at this time, there is no impact on RCMP operations and no known threat to the safety and security of Canadians,” a spokesperson

Leaked documents may show the inside of China’s hacking strategy

Documents apparently stolen by disgruntled employees to embarrass their firm may give insight into China's cyber

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways