A US-based used electronic retailer has exposed over 2.6 million files following the discovery of a misconfigured AWS S3 bucket.

Researchers at Website Planet were able to trace the instance back to California-based TronicsXchange, formerly known as GreenElectronicsExchange (GEEx).
A server vulnerability scan led Website Planet to discover a wide open S3 bucket on October 12, 2020. The company itself appeared to be shutdown, Website Planet was therefore unable to contact AWS about the issue until 24 hours later.
There were over 80,000 images of personal identity cards, such as driver licenses, out of the millions of files found in the database, and over 10,000 fingerprint scans of the files.
The driver’s license photo exposes information about the individual, including license number, full name, birthdate, home address, gender, hair and eye color, height and weight, etc.
The leaked data mostly belonged to Californians who visited stores operated by TronicsXchange during 2012-15, according to a report seen exclusively by Infosecurity.
It’s unclear if any malicious actors took advantage of this exposed data store prior to Website Planet finding it, but the researchers reminded the world that doing so is becoming easier now thanks to automated tools. They warned that the data could have been used to apply for credit cards or open bank accounts.
Considering that government-issued documents were exposed, unauthorized users may potentially conduct identity fraud across different platforms and institutions.

News Site: infosecurity-magazine.com