Exploit: Unsecured Database
District of Columbia Bar Association: Regulatory Body
Risk to Small Business: 2.077 = Severe
An unsecured Elasticsearch server appears to be at fault for a data breach involving the personal data of new lawyers applying to test before the bar at the District of Columbia Bar Association. A whistleblower complaint was first submitted to the association in August, but resolution was slow, and applicant data may have leaked for some time before it was fixed. The DC Bar claims that only one record was exposed, but researchers and applicants who discovered the breach dispute that claim.
Individual Risk: 2.206 = Severe
Documents uploaded by applicants that may have been exposed include documents containing personal information like names, phone numbers, email addresses, Social Security numbers, the applicant’s full employment history, previous home addresses, and any disciplinary records provided.
Customers Impacted: Unknown
How it Could Affect Your Customers’ Business: Serious personal information deserves serious security. Any company that collects sensitive information about clients or applicants needs to do due diligence to determine that the information is properly secured.
Source:
https://techcrunch.com/2020/09/30/district-columbia-bar-exposed-personal-data