[Resolved][Severity: Major][Web app exploit]

Eki Rent-A-Car System: intrusion into its website leaked 253,979 mail addresses of customers who booked through Rail & Rent-A-Car

A weakness in an added booking mechanism was exploited. A customer reported suspicious mail, and the firm confirmed the mail address leak on December 7.

Disclosed

2020-12-11

Organizations involved

Leaked or at risk

254K

253,979

Downtime

Unknown

What happened

2020-12-01
A customer reported suspicious mail, and the firm began checking its systems. [1] [2] [3]
2020-12-07
The firm confirmed that customers' mail addresses had leaked through an attack on a vulnerability. [1] [2]
2020-12-11
It published a first notice of the leak. [3]
2020-12-18
It published the details and, between 15:00 and 16:00, emailed customers whose addresses had leaked. It reported to and consulted the authorities and the police. [1] [2]

Impact and cause

The leak covers 253,979 mail addresses of customers who booked via the Rail & Rent-A-Car link on the site. It also includes 42 separate birth-date fragments (year only, month only or day only), 65 mail addresses of rental offices, and 1,359 phone numbers and 1,382 fax numbers of offices. Customers who booked by other online routes or by phone are not affected. [1] [2]

The cause was an added system whose design left it open to attack. A flaw sat in the flow where a customer enters a mail address and receives a reply with a URL for the next step. The firm tightened monitoring and the site and commissioned an outside assessment. [2] [3]