{"id":17841,"date":"2020-12-14T11:16:03","date_gmt":"2020-12-14T10:16:03","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=17841"},"modified":"2020-12-14T11:16:03","modified_gmt":"2020-12-14T10:16:03","slug":"uk-tax-relief-company-exposes-customers-personal-information-in-data-leak","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/12\/14\/uk-tax-relief-company-exposes-customers-personal-information-in-data-leak\/","title":{"rendered":"UK Tax Relief Company Exposes Customers' Personal Information In Data Leak"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline\" src=\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2015\/01\/Schutz.jpg\" width=\"40\" align=\"left\" height=\"47\">Security Researchers from Website Planet found, that an UK Tax Relief Company Exposes Customers' Personal Information due to a misconfigured web server. Here are a few details about this Data Leak.<\/p>\n<p><!--more--><\/p>\n<p>I got the information during the weekend, that the Website Planet security team identified &#8211; as part of conducting routine server scans for potential vulnerabilities &#8211; a misconfigured web server belonging to Marriage Tax Allowance Ltd, a UK-based company specialising in recovering marriage tax allowance funds for clients. <\/p>\n<p><img decoding=\"async\" title=\"Security\" alt=\"Security\" src=\"https:\/\/i.imgur.com\/Vtjh6ZH.jpg\"><br \/>(Security, Source: Pexels free use)  <\/p>\n<p>Due to a lack of security measures, they left the directory listing enabled for public view, exposing their customers' information such as the couples' full names, full home address and refund amount. The team found over 100,000 files totaling approximately 5GB of data affecting&nbsp; &gt;100,000 people on this server.  <\/p>\n<p>Marriage Tax Allowance Ltd misconfigured its WordPress content management system (CMS), thereby leaving the directory listing enabled for public view. This allowed anyone to browse the entire list of files stored on the website. More specifically, letters to customers, containing customer information, were written to the same directories. The vulnerability meant that anyone attempting to access the company's directory listing could have done so without encountering basic security measures such as password protection.  <\/p>\n<p>Accessing the correct URL allowed users to access the full pipedrive database. All the exposed data was contained in .PDF files and included Personally Identifiable Information (PII) such as:  <\/p>\n<ul>\n<li>Applicant's full name\n<li>Applicant's gender\n<li>Full Home address\n<li>Partner's full name\n<li>Partner's gender\n<li>Refund amount customers could request<\/li>\n<\/ul>\n<p>The lack of adequate security meant the company allowed hundreds of thousands of PDF files showing customers' personal information to become exposed. According to the research team, each customer, or couple, had two files associated with them \u2013 one document showing each couple's details and a further \"thank you\" document, kept on record to inform the applicants that their submission was approved (and that they would be receiving a refund).  <\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"UK marriage tax relief specialist Exposes Customers\\' Personal Information In Data Leak\" src=\"https:\/\/dt2sdf0db8zob.cloudfront.net\/wp-content\/uploads\/2020\/11\/uk-marriage-tax-relief-specialist-exposes-customers-personal-information-in-data-leak-1.jpeg\" width=\"603\" height=\"572\"><br \/>PDF scan showing customer personal information and estimated refund amount<img loading=\"lazy\" decoding=\"async\" alt=\"UK marriage tax relief specialist Exposes Customers\\' Personal Information In Data Leak\" src=\"https:\/\/dt2sdf0db8zob.cloudfront.net\/wp-content\/uploads\/2020\/11\/uk-marriage-tax-relief-specialist-exposes-customers-personal-information-in-data-leak-2.jpeg\" width=\"614\" height=\"483\"><br \/>PDF scan showing customer application form including personal information  <\/p>\n<p>More details about the data leak, the the risks of leaving such information exposed etc. may be found on <a href=\"https:\/\/www.websiteplanet.com\/blog\/marriagetaxrefund-leak-report\/\" target=\"_blank\" rel=\"noopener\">the Website Planet report<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security Researchers from Website Planet found, that an UK Tax Relief Company Exposes Customers' Personal Information due to a misconfigured web server. Here are a few details about this Data Leak.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580],"tags":[69],"class_list":["post-17841","post","type-post","status-publish","format-standard","hentry","category-security","tag-security"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/17841","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=17841"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/17841\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=17841"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=17841"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=17841"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}