Today we report on two more recent information security incidents.

Let’s start with the case of Ascentis, the developer of an e-commerce platform owned by Starbucks, which was fined S$10,000 for failing to appropriately protect confidential information. 

The company was fined for the leak, which occurred in September 2022. At that time, approximately 333,000 members of Starbucks' loyalty program, My Starbucks Rewards, were affected by the incident. Membership information, including: 

• Full names 
• Dates of birth 
• Mobile phone numbers  
• Email addresses 

was offered for sale on the Darknet.

How the incident happened: The Ascentis have contracted the Vienam-based company Kyanon Digital to get assistance. The employees of Kyanon had accounts with full administrative privileges, which, among other, enabled employees to export data from the platform. As it was revealed, there was an employee, who had worked for Kyanon Digital and left the company. His account credentials were handed over to some other employees via a shared Google Sheet. The former employee’s account wasn’t disabled. The employees changed the former employee account’s password and updated it in the Google Sheet. Lately, a malicious actor gained access to the unblocked account and used it to obtain and steal the confidential data.

The Personal Data Protection Commission in its judgement stated that the amount of fine was based on marketing agency's active cooperation in the investigation and its prompt action to remedy the breach.

The second incident resulted in a large amount of customers’ personal information being publicly available for several months.

Strendus, a Mexican online casino, exposed 85GB of confidential players’ data. The open instance also contained data from another online casino, MustangMoney.

The following casino player details were exposed in the incident:

• Usernames
• Full Names
• Government ID numbers (CURP)
• Phone numbers
• Email addresses
• Home addresses
• Dates of Birth
• Deposit amounts and withdrawal amounts
• IP addresses used to register for an account and log in.

For now it is not known exactly how the data ended up in the public domain. Cyber security researchers Cybernews, who discovered the leak, suggested that the data became publicly available as a result of unauthorised access to the logs. The researchers also claim that they discovered the leak on 7 April 2023, after which they immediately alerted the company.  However, the data remained publicly available until mid-October.

As technology advances, attackers are becoming more sophisticated. Deepfakes are a perfect example of this. We recently discussed how deepfakes are created and how they can be used fraudulently.