Data management software provider Attunity now owned by Qlik, left massive amounts of backup data exposed on Amazon Web Services (AWS), according to the UpGuard Data Breach research team. The exposure surfaced roughly around the time that Qlik finalized its Attunity acquisition for $560 million.
The Attunity exposure appears to involve each of those issues. According to a statement from UpGuard:
"The UpGuard Data Breach Research team can now disclose that a set of cloud storage buckets utilized by data management company Attunity have been secured from any future malicious action. Attunity, recently acquired by business intelligence platform Qlik, provides solutions for data integration. An UpGuard researcher discovered three publicly accessible Amazon S3 buckets related to Attunity. Of those, one contained a large collection of internal business documents. The total size is uncertain, but the researcher downloaded a sample of about a terabyte in size, including 750 gigabytes of compressed email backups. Backups of employees’ OneDrive accounts were also present and spanned the wide range of information that employees need to perform their jobs: email correspondence, system passwords, sales and marketing contact information, project specifications, and more."
Read between the lines, and Attinuty apparently locked down the AWS buckets after UpGuard alerted the company to the issue.
The data exposure reinforces several challenging trends in cybersecurity. Chief among them:
AWS Public Cloud Data Leaks: Who Exposed Data?
Numerous companies and organizations have accidentally exposed data via AWS cloud services. The exposure list includes:
AWS Public Cloud Data Leaks: Improving Cybersecurity
Amazon has taken several steps to help customers configure and lock-down their AWS workloads. The example moves include:
Those all sound like steps in the right direction -- potentially driving down one of the biggest risks in IT security: Human error.
