A Billion People’s Data Left Unprotected on Google Cloud Server

Kartikay Mehrotra (Bloomberg) -- A database aggregating 1.2 billion users’ personal information, including social media accounts, email addresses and phone numbers, was discovered unprotected on a server last month. So far, it’s not clear how it got there.

Most of the data was collected by a company called People Data Labs, said Vinny Troia, chief executive officer of Night Lion Security, which is based in St. Louis. People Data Labs provides work emails and social media account details for what the company claims is a billion and a half people. That data is scraped from various sources and sold as a way to contact “70%+ decision makers in the US, UK and Canada,” according to the company’s website.

The unprotected data didn’t reside on a People Data Labs’ server, but rather was on a Google Cloud server, Troia said. Google didn’t respond to a request for comment about who was renting the server.

Sean Thorne, People Data Labs’ co-founder and chief executive officer, said some, but not all, of the data came from his company and suspects it was being aggregated by another firm merging various data points.

“We’re committed to ensuring that our bulk data dumps are not exposed,” People Data Labs says on its website. “We’re extremely sensitive to this and have multiple white-hat partners who are searching the internet in an effort to find vulnerable data sets and clamp down on them before they are discovered by nefarious actors.”

Related:How to Secure AWS Storage Buckets

The discovery was previously reported by Wired.

Troia, who made the discovery in October during a routine scan for unprotected data, said he reported the four terabyte trove and its location to the Federal Bureau of Investigation. The server has since been shut down, he said. The FBI didn’t immediately responded to requests for comment.

Troia says he doesn’t know who left the data on that server, saying it could be malicious hackers or People Data Labs’ own customers. He said the discovery of social media accounts would be particularly valuable in the hands of criminal hackers or peddlers of misinformation.

”This is the first time ever that I’ve seen emails, names and numbers linked with Facebook, Twitter, LinkedIn and Github profiles all in one spot,” said Troia, who describes himself as a cybercrime hunter. “There are no passwords related to this data, but having a new, fresh set of passwords isn’t that exciting anymore. Having all of this social media stuff in one place is a useful weapon and investigative tool.”