OCR Labs denies data breach reports, patches vulnerability

London-based OCR Labs, which provides digital ID verification tools to major companies, government agencies, and financial institutions, has denied a breach report that a misconfiguration of the OCR Labs system systems exposed sensitive credentials to the public.

Earlier, several media reports claimed that the Cybernews research team discovered a misconfiguration, exposing sensitive data and impacting institutions like QBANK, Defence Bank, MA Money, Bloom Money, Admiral Money, and Reed.

Reportedly, the Cybernews research team discovered a publicly accessible environment file (.env) belonging to OCR Labs product IDKit.com, which provides bank-grade identity verification with selfie biometrics.

The file contained database credentials, including host, port, and username, Amazon Web Services (AWS) with Simple Queue Service (SQS) access credentials, application tokens, and various application programming interface (API) keys. Researchers also claimed to have discovered Google and Liveness API keys among the stolen information. These keys are used in the digital identification process to determine whether a sample comes from a real or fake person, preventing spoofing or account-holder impersonation.

In a response statement, Paul Warren-Tape, GM of APAC for OCR Labs, said there was never a data leak or breach in their systems. An internal investigation by OCR Labs showed no risk to the security of any client’s data. In the meantime, OCR Labs admitted that it took all necessary steps to patch the vulnerability discovered and disclosed by Cybernews researchers.

Warren-Tape said that after extensive investigation, the company could unquestionably confirm the discovered configuration related to invalid and placeholder credentials was for unused demo and placeholder environments. These are all non-production environments and pose no risk to the security of our client’s data or systems. The company is now seeking independent legal advice on the allegedly inaccurate reporting.