[Resolved][Severity: Major][Misconfiguration]

AEON Bank: a settings flaw in the cloud system behind its visit reservation and online consultation service let a third party view names and more of 2,062 customers

The bank found access by a third party through a settings flaw and stopped the service on January 29 and 30 to fix it. No account numbers or PINs were included.

Disclosed

2021-02-22

Organizations involved

Leaked or at risk

2.1K

2,062

Downtime

Unknown

What happened

2021-01-29
An investigation the bank started after attacks on cloud systems at other companies since around December 2020 found that data in the reservation system could be viewed from outside. It stopped the service on this day and the next, changed the settings, confirmed safety and resumed. [1] [2]
2021-02-22
A check of past access showed that a third party had actually viewed part of the customer data, and the bank disclosed the case. [1] [5]

Impact

What was viewed were the names of 2,062 customers (including those with only a family or given name) and, for them, 608 phone numbers, 49 mail addresses, 227 customer management numbers, 779 records of whether they held an account with the bank, 15 preferred branches and times, and 13 consultation topics. Account numbers, credit card numbers and PINs were not included. There has been no unauthorized access since the resumption and no damage to customers. [1] [3] [5]

The service had been running since March 2018. The bank did not name the external cloud service with the flaw or say when the access happened, and press reports said it appeared to be a Salesforce service. Some reports give 799 for the account records; this page uses the bank's figure of 779. [1] [3] [4]