Another day, another discovery of an exposed online database. Today’s “We didn’t secure our online database” story involves 198 million records exposed via an Elasticsearch database belonging to Dealer Leads, a provider of online services to the automotive industry.

Discovered by Jeremiah Fowler, senior security researcher at Security Discovery, the exposed database included names, email addresses, phone numbers, physical addresses, internet addresses and other personally identifiable information.

The database was a compilation of potential car buyers wanting more information, loan and finance inquiries, vehicles that were for sale and log data which had been gathered from various sources, some purchased. Dealer Leads itself offers multiple services to the automotive digital marketing industry including classified sites, service sites and other vehicle-related services.

Dealer Leads did act quickly to restrict access to the database once informed by Fowler Aug. 20. “Unfortunately, the data was exposed for an undetermined length of time and it is unclear who else may have had access to the millions of records that were publicly exposed,” Fowler said. “This is another wakeup call for any organization that collects and stores large amounts of data. It is crucial to ensure that the proper safeguards are in place.”

Oscar Tovar, application security specialist at application security provider WhiteHat Security Inc., told SiliconANGLE that the incident highlights not only the damage to people’s privacy but the damage to a brand’s reputation that can result.

“The biggest lesson that can be taken away is that all personal information should be treated with the highest of concern.,” Tovar said. “There should not be any circumstance where private information storage is exposed publicly. There is not any margin for error when it comes to this since once a leak happens there is no going back.”

Noting how easy it has become to identify databases like that of Dealer Leads, Tovar added that “a simple search on shodan.io will show a plethora of S3 buckets, and Database API Endpoints that are publicly accessible without any security restraints.”

“This leak should serve as a reminder that network-attached infrastructure should constantly be audited for best practices and recommended security configurations,” Tovar said.

Image: Dealer Leads