Major data exposure affects 300,000 taxi passengers in the UK and Ireland

Cybersecurity researchers have uncovered significant data exposure that affects nearly 300,000 taxi passengers in the UK and Ireland. In collaboration with vpnMentor, Jeremiah Fowler discovered a non-password-protected database containing sensitive personal details, including names, phone numbers, and email addresses. The database belonged to iCabbi, a Dublin-based dispatch and fleet management technology provider.

The exposed database, containing 22,745 records and .csv documents, revealed customers’ names, emails, phone numbers, and user IDs. Email addresses from various providers and private domains, including Gmail, Hotmail, Yahoo, iCloud, Outlook, and Live, as well as those from media outlets and government agencies like the BBC, NIH, HM Treasury, and Ministry of Justice, were compromised.

Javvad Malik, lead security awareness advocate at KnowBe4, expressed concerns over the potential security implications, stating that the exposure opens avenues for identity theft and targeted phishing attacks. Furthermore, including high-profile individuals elevates the risk of complex social engineering and espionage efforts.

Jeremiah Fowler, upon investigation, found that the database served as a storage repository for various documents used by the application. While only specific documents were publicly accessible, the risk of cybercriminal exploitation remains.

Fowler promptly notified iCabbi of the issue, to which the firm responded transparently, acknowledging the error and swiftly deleting the exposed records. Adam Pilton, a cybersecurity consultant at CyberSmart, commended iCabbi’s response, emphasizing the importance of proactive and transparent actions in such situations.

However, Erfan Shadabi, a cybersecurity expert at Comforte AG, highlighted the broader risks associated with vulnerabilities and misconfigurations within organizational systems. Shadabi urged organizations to adopt a data-centric security approach, such as tokenization, to protect sensitive information and ensure data integrity and confidentiality.