Data Leak Exposes Sensitive Employee Information of Major Firms Like Dell, Capital One, and Verizon: Implications and Preventative Measures

Data Leak Exposes Sensitive Employee Information of Major Firms Like Dell, Capital One, and Verizon: Implications and Preventative Measures
Image credit: Pixabay

A recent data leak has reportedly affected approximately 900 companies, including prominent firms such as Dell, Capital One, and Verizon. This breach has resulted in the exposure of employee data online, raising significant security concerns.

Discovery of the Leak

The third-party app ‘Simpli’ (formerly Charm City Concierge) was discovered to have a publicly accessible web directory, which exposed up to 10,000 employee credentials from the affected companies. Researchers at Cybernews found the information in an open web directory containing backups of the app's database and website from January 2024.

Sensitive Information Exposed

The exposed data includes email addresses, hashed passwords, and detailed meeting information, such as the purpose of meetings and attendees. Many employees registered for the third-party service using corporate email addresses, potentially leaving companies vulnerable to malicious actors targeting work-related endpoints.

Risks of Supply Chain Attacks

This incident underscores the increasing risk of supply chain attacks on businesses. While companies have become more vigilant about cybersecurity, weaker elements within a supply network have become targets for threat actors seeking access to otherwise secure company data. Suppliers and third parties often hold sensitive company and customer information, making them effective entry points for cybercriminals.

Impact and Recommendations

Details and potentially sensitive operational information exposed through app orders and notes leave organizations vulnerable to data theft and other malicious activities. Recent research indicates that third-party attack vectors account for nearly 30% of data breaches in recent years. With about 98% of organizations associated with a third party that has experienced a data breach, this poses a serious security concern.

Preventative Measures

Security experts advise leaders to ensure robust third-party risk management plans are in place to prevent and recover from security breaches. As companies continue to grapple with the complexities of supply chain security, comprehensive risk management strategies are essential to safeguard sensitive data and maintain operational integrity.