Social Wire: flawed @Press API leaked member data; 41,981 records under investigation

A check on 29 October found that part of an internal integration API of the @Press press-release service lacked proper authentication and access control. Logs show member data was sent to a third party through it. The unauthorized access ran from 25 June to 28 October. [1] [2]

It fixed the API and blocked the path the same day, and blocked connections from another path early on 30 October. No successful data retrieval has been recorded since. It disclosed the breach on 2 November. [1] [2]

The investigation covers 41,981 member records. The API handles company names, contact persons’ names and contact details, billing details, internal notes, login IDs and hashed passwords. Responses were not logged, so what was taken for each member cannot be fully established. No account takeover or unauthorized release distribution has been found. [1] [2]

It is reviewing the whole system, including related APIs, and tightening authentication and access control. It asked all users to reset their passwords and emailed the members under investigation. [2] [1]