Blog Layout

Gaming hardware giant Razer exposed customer data via misconfigured database

Leo Daniels • Sep 14, 2020

This is a subtitle for your new post

Global gaming hardware manufacturing company Razer leaked the personal information of around 100,000 customers by storing their data in an Elasticsearch cluster that was misconfigured to enable public access, security researcher Bob Diachenko has revealed.
The personal information of around 100,000 Razer customers was stored by the company in a large log chunk within an Elasticsearch cluster. The cluster was indexed by several public search engines as it was misconfigured for public access since 18th August.

According to Diachenko, who is well-known for unearthing publicly-exposed online databases, personal information stored in the log included full names, email addresses, phone numbers, customer internal IDs, order numbers, order details, billing, and shipping addresses.

“The customer records could be used by criminals to launch targeted phishing attacks wherein the scammer poses as Razer or a related company,” Diachenko said, adding that customers should be on the lookout for malicious emails or messages that might encourage them to click on links to fake login pages or download malware onto their device.

“We were made aware by Mr. Volodymyr [Diachenko] of a server misconfiguration that potentially exposed order details, customer, and shipping information. No other sensitive data such as credit card numbers or passwords were exposed,” Razer said after the breach was disclosed by Diachenko.

“The server misconfiguration has been fixed on 9 Sept, prior to the lapse being made public. We would like to thank you, sincerely apologize for the lapse, and have taken all necessary steps to fix the issue as well as to conduct a thorough review of our IT security and systems. We remain committed to ensuring the digital safety and security of all our customers,” the company added.

Commenting on the latest instance of a company exposing customer via a misconfigured online database, Chris DeRamus, VP of Technology, Cloud Security Practice at Rapid7, said to avoid cloud misconfigurations, companies need to immediately shift toward a new model of security that provides continuous controls and enforces secure configurations of cloud services, instead of attempting to do so only after a breach has occurred.

“Organisations need a security solution that provides the automation essential to enforce policy, reduce risk, provide governance, impose compliance, and increase security across a large-scale, hybrid cloud infrastructure. Automation takes the headache out of making cloud infrastructure secure in a shared responsibility world by providing a framework for what organizations should be doing via a continuous, real-time process.

“By leveraging security automation, companies can stay agile and innovate while maintaining the integrity of their technology stacks and applying the unique policies necessary to operate their businesses,” he added.

 

We’re 1-fix, we can help you secure your business

At 1-fix, we take a realistic approach to technology – ensuring our client’s systems are best protected.

If you have any concerns, questions or simply want to explore how to better secure your business, please do get in touch with the team for a FREE demonstration, consultation to explore how exposed your business might be and identify actions to take.

Join Our Mailing List

All sign-ups are handled inline with our privacy policy and can unsubscribe at any time.

IT Support Services
Cybersecurity Deep-Dive
IT Cloud Migration Service

Recent Blogs

By Craig Atkins 27 Mar, 2024
We've finalists for not one, but two Network Group Awards 2024!
By Craig Atkins 22 Mar, 2024
World Backup Day is just around the corner so we thought we'd share a few reasons why backing up your computers regularly is so important.
By Craig Atkins 15 Mar, 2024
John Clark, from Solutions Shared joined us on a webinar to discuss what Microsoft Power Apps are and how they can be used in your business.
By Lee Dugdale 13 Mar, 2024
This blog answers FAQs about Cyber Essentials such as 'What is Cyber Essentials?', 'Why do I need Cyber Essentials?' and 'Do all businesses need Cyber Essentials'
By Jess Dugdale 08 Mar, 2024
This year we went all out to celebrate International Women's Day, with our first Women in Business event yesterday at the Thames Lido.
By John Clark 05 Mar, 2024
John Clark, from Solutions Shared Ltd , shares his Top 10 things that you may not know Microsoft Power Apps could do.
Show More
Share by: