Forest Global Training Partners

Cyber Risks · Krebs on Security

Many Public Salesforce Sites are Leaking Private Data

Summary: A misconfiguration in Salesforce Community lets unauthenticated guest users reach records that should require login, and KrebsOnSecurity found exposures at DC Health (five sites), the state of Vermont (at least five sites, including a Pandemic Unemployment Assistance program leaking names, Social Security numbers, addresses, phone numbers, emails and bank account numbers), and TCF Bank, now owned by Huntington Bank, which leaked commercial loan documents. Researcher Charan Akiri wrote a program that identified hundreds of other organizations with misconfigured Salesforce pages, and said he received no response from the government organizations he contacted in January and February 2023.

Key Takeaway: Vermont CISO Scott Carbee said his team is frustrated by the permissive nature of the platform and that the sites were stood up rapidly during the pandemic without the normal security review, while D.C. interim CISO Mike Rupert initially said a third party had confirmed the District was not vulnerable, then acknowledged his team had overlooked some configuration settings after being shown a live document containing a health professional's Social Security number.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related