Estée Lauder hit with huge data breach

Cybersecurity researcher Jeremiah Fowler of Security Discovery has uncovered a huge and completely unprotected customer database owned by the cosmetic giant Estée Lauder.

More than 440 million individual data entries were found sitting in plaintext in a cloud database. The records included email addresses and data from the local CMS. No payment data or sensitive employee information was compromised.

“This company has been a household name for over 70 years and had an annual revenue of $14.863 billion in 2019 – it seems logical that there would be a large dataset associated with the business,” Fowler wrote.

He added that he still hasn’t identified how many different people can be found in the database, instead rushing to alert the company to the issue. Estée Lauder managed to close the database within 24 hours of Fowler's alert, but it's unclear how long the data remained exposed.

Internal emails could be used for phishing attacks, with hackers posing as team members to trick employees into downloading malware. IP addresses, ports, pathways and storage information could also be used to map out the company’s internal LAN or WAN.

source itproportal

Industry: Cyber Security