Gaming hardware giant Razer exposed customer data via misconfigured database

Gaming hardware giant Razer exposed customer data via misconfigured database

Gaming hardware giant Razer exposed customer data via misconfigured database

Global gaming hardware manufacturing company Razer leaked the personal information of around 100,000 customers by storing their data in an Elasticsearch cluster that was misconfigured to enable public access, security researcher Bob Diachenko has revealed.

The personal information of around 100,000 Razer customers was stored by the company in a large log chunk within an Elasticsearch cluster. The cluster was indexed by several public search engines as it was misconfigured for public access since 18th August.

According to Diachenko, who is well-known for unearthing publicly-exposed online databases, personal information stored in the log included full names, email addresses, phone numbers, customer internal IDs, order numbers, order details, billing, and shipping addresses.

“The customer records could be used by criminals to launch targeted phishing attacks wherein the scammer poses as Razer or a related company,” Diachenko said, adding that customers should be on the lookout for malicious emails or messages that might encourage them to click on links to fake login pages or download malware onto their device.

“We were made aware by Mr. Volodymyr [Diachenko] of a server misconfiguration that potentially exposed order details, customer, and shipping information. No other sensitive data such as credit card numbers or passwords were exposed,” Razer said after the breach was disclosed by Diachenko.

“The server misconfiguration has been fixed on 9 Sept, prior to the lapse being made public. We would like to thank you, sincerely apologize for the lapse, and have taken all necessary steps to fix the issue as well as to conduct a thorough review of our IT security and systems. We remain committed to ensuring the digital safety and security of all our customers,” the company added.

Commenting on the latest instance of a company exposing customer via a misconfigured online database, Chris DeRamus, VP of Technology, Cloud Security Practice at Rapid7, said to avoid cloud misconfigurations, companies need to immediately shift toward a new model of security that provides continuous controls and enforces secure configurations of cloud services, instead of attempting to do so only after a breach has occurred.

“Organisations need a security solution that provides the automation essential to enforce policy, reduce risk, provide governance, impose compliance, and increase security across a large-scale, hybrid cloud infrastructure. Automation takes the headache out of making cloud infrastructure secure in a shared responsibility world by providing a framework for what organizations should be doing via a continuous, real-time process.

“By leveraging security automation, companies can stay agile and innovate while maintaining the integrity of their technology stacks and applying the unique policies necessary to operate their businesses,” he added.

Image source: Razer

Read More: Driving licences of 54k Australians leaked via misconfigured S3 bucket

Copyright Lyonsdown Limited 2021

Top Articles

The expert view: Accelerating the journey to the cloud

At a virtual seminar on 9 June 2021, sponsored by managed IT service provider Sungard Availability Services, eight senior IT decision makers gathered to discuss how organisations can accelerate their…

Ransomware attacks and the future role of the CISO - teissTalk

On 18 May, teissTalk host Jenny Radcliffe was joined by a panel of four cybersecurity experts in a wide-ranging discussion that covered government actions, ransomware attacks and the future of…

Communicating a Data Breach: Best Practices

When customers trust you with their personal data, they are expecting it to be protected. This means your response to a data breach is imperative and can make or break…

Related Articles

[s2Member-Login login_redirect=”” /]