Millions of Dow Jones customers exposed on misconfigured AWS server

At least two million Dow Jones customers have had personal details exposed online via an unsecured cloud file repository.

Dow Jones, which owns the Wall Street Journal, confirmed to cyber security firm UpGuard that at least 2.2 million customers were affected, though UpGuard estimates the number to be closer to four million accounts.

The exposed information included the names, addresses, account information, email addresses, and last four digits of credit card numbers.

There were also 1.6 million exposed entries in a collection of databases known as "Dow Jones Risk and Compliance", which are subscription-based programs used by financial institutions to understand how to be compliant with anti-money laundering regulations.

The data was found on an Amazon Web Services (AWS) S3 bucket, and had been configured to allow any AWS "Authenticated Users" to download the data. Amazon defines an authenticated user as any person with an AWS account, of which there are over a million users, and is free to sign up to.

Dan O'Sullivan, cyber resilience analyst at UpGuard, stated that the unsecured information "would be of use to any spammers or digital marketers, but could also be used [for a] far more malign effect".

Malicious actors, for instance, could use the information for phishing, pretending to be from the Wall Street Journal and telling customers their account had been compromised or that there was a problem with their subscription.

Dow Jones isn't the only company to have exposed customer details online via an AWS server – a Verizon data breach last week saw six million customer records compromised on an unprotected AWS S3 storage server. Each record included the customer's name, mobile number, and account PIN as well as their home and email address, and Verizon account balance.

Verizon stated that there was no loss or theft of Verizon customer information and that "the overwhelmingly majority of information in the data set had no external value, although there was a limited amount of personal information included".

Meanwhile, the WWE exposed three million fans' accounts online in the same manner, and the AA also suffered a similar fate.

Dow Jones was contacted for a comment.

This article originally appeared at itpro.co.uk