

Another day, another misconfigured cloud instance exposing data, and the latest comes from AavGo, a cloud-based software provider for the hotel industry.
The latest case involves a misconfigured Elasticsearch database revealed today by security researcher Daniel Brown. The database in question, now offline, included hotel guest information, including booking and personally identifiable information, internal hotel memos, admin login details, invoices and work orders.
About 8 million lines of hotel-related code were found in the exposed database, though the names of AavGo clients were not disclosed. AavGo clients, according to its website, include Best Western International Inc., Crowne Plaza and Days Inn.
“The reason this happened is that there’s an Elasticsearch engine that’s installed on this server with no authentication mechanism activated and the server itself is accessible from the internet, making the Elasticsearch data open for anyone to look at – and this server has logs from production systems so it has a lot of sensitive information,” Brown wrote.
Chris DeRamus, chief technology officer and co-founder of cybersecurity firm DivvyCloud Corp., told SiliconANGLE that developers and engineers can often move too quickly when using cloud services such as Aavgo and bypass critical security and compliance policies.
“Leaving servers unprotected seems like such a simple mistake to avoid, but more and more companies suffer data breaches as the result of misconfigurations, and we read about them in the news almost every day,” DeRamus said. “The truth is, organizations are lacking the proper tools to identify and remediate insecure software configurations and deployments on a continuous basis. Automated cloud security solutions give companies the ability to detect misconfigurations and alert the appropriate personnel to correct the issue, and they can even trigger automated remediation in real-time.”
AavGo is not the first company to expose data via a misconfigured Elasticsearch database. Some 24 million financial and banking documents were found exposed on a misconfigured Elasticsearch database belonging to data analytics company Ascension in January, and 57 million records believed to belong to Data & Leads Inc. were found exposed online in the same fashion in November.
Support our open free content by sharing and engaging with our content and community.
Where Technology Leaders Connect, Share Intelligence & Create Opportunities
SiliconANGLE Media is a recognized leader in digital media innovation serving innovative audiences and brands, bringing together cutting-edge technology, influential content, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios — such as those established in Silicon Valley and the New York Stock Exchange (NYSE) — SiliconANGLE Media operates at the intersection of media, technology, and AI. .
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a powerful ecosystem of industry-leading digital media brands, with a reach of 15+ million elite tech professionals. The company’s new, proprietary theCUBE AI Video cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.