View source for Unsecured Database Reveals Sensitive Info About Movie Chain Customers

id="article-body" class="row" section="article-body"><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>An exposed database revealed sensitive information on customers of a Peruvian movie theater chain, a researcher says.<br><br>Graphic by Pixabay/Illustration by CNET<br><br><br>An [/news/exposed-databases-are-as-bad-as-data-breaches-and-theyre-not-going-anywhere/ unsecured database] left sensitive information of thousands of movie buffs open on the internet for  [https://www.kynghidongduong.vn/tours/tour-du-lich-trung-khanh-cuu-trai-cau-thanh-do-ha-noi-sai-gon.html kynghidongduong.vn] anyone to see, a security researcher said Monday. The information included full names, email addresses, unencrypted passwords, partial payment information and government ID numbers of film lovers who made purchases with Peruvian company Cineplanet. <br>The open database, which anyone with the correct IP address could access on a web browser, also exposed information about members of the company's loyalty program, including employment and marital status.  There's no indication that cybercriminals accessed the data,  [https://www.kynghidongduong.vn/tours/tour-du-lich-trung-khanh-cuu-trai-cau-thanh-do-ha-noi-sai-gon.html tour cửu trại câu từ hà nội] though that can't be ruled out.<br><br>The database, which was stored on a cloud server, is no longer exposed online. Cineplanet confirmed that the data was removed from the internet once the company learned of the exposure on Thursday. In a statement Monday, the company said the exposure affected less than 4% of its registered customers. The company lists roughly [ 40 theater locations] across the South American country on its website,  [https://www.kynghidongduong.vn/tours/tour-du-lich-trung-khanh-cuu-trai-cau-thanh-do-ha-noi-sai-gon.html tour cửu trại câu giá rẻ] with 23 in the capital city of Lima. <br><br>The exposure marks the latest example of sensitive personal information being left unsecured on a cloud database, an ongoing problem affecting privacy around the world. Companies are moving their customer data to cloud servers because of the flexibility and savings they offer. But many organizations don't have the IT expertise to set up those databases securely. In the past year, databases have exposed patient records from [ ], information about [ ], and the [ ] of job seekers.<br><br>The researcher who found the database, Anurag Sen, [ published his findings] on Monday with antivirus review website SafetyDetective and shared the research with CNET. The database appeared to only keep records for a one-month period, and about 1.5 million new records appeared on the website each day Sen observed it, he said. <br> <br><br>Exposed databases<br><br><br>[/news/exposed-databases-are-as-bad-as-data-breaches-and-theyre-not-going-anywhere/ Exposed databases are as bad as data breaches, and they're not going anywhere]<br><br>[/news/your-most-sensitive-data-is-likely-exposed-online-these-people-try-to-find-it/ Your most sensitive data is likely exposed online. These people try to find it]<br><br>[/news/how-encryption-could-stop-personal-data-exposures-on-the-cloud/ How encryption could stop personal data exposures on the cloud]<br><br><br><br><br><br>Currently, the most straightforward way to keep databases secure is with password protection. However, many software tools that manage cloud databases don't enable password protection by [http://www.ehow.com/search.html?s=default default]. Even when password protection is the default setting, the IT staff that sets up databases often unwittingly disables it, according to researchers. <br><br>How many exposed databases with no password protection are there? "More than you could possibly imagine," said Chris Vickery, a researcher who [ ] and wasn't involved in finding the Cineplanet database.<br><br>One [/news/how-encryption-could-stop-personal-data-exposures-on-the-cloud/ potential solution is encryption], which scrambles up data before storing it on the cloud. The technology is in its early stages.<br><br>The Cineplanet database exposed roughly 250,000 DNI numbers, Sen said, which is the 8-digit number associated with the [ Documento Nacional de Identidad], or national identity document. It's a form of ID used for travel, accessing government services and voting in Peru. <br><br>It was more difficult to gauge how many passwords and other unique pieces of information were exposed among the millions of records. The data would be valuable to hackers who could try to use the exposed passwords to log into more sensitive accounts, like email or banking accounts. Because so many internet users reuse their passwords, these kinds of attacks can be very lucrative for hackers. <br><br>It could also be valuable to identity thieves, especially details like marital status and payment information. Even though there aren't signs that hackers have been abusing the Cineplanet data, [ ] say to treat database exposures as seriously as if a hacker had gone out and stolen your information. That means watching your payment cards for fraudulent transactions and being mindful that fraudsters might use your personal information in phishing attacks.<br><br>Originally published Jan. 27.<br>Updates, Jan. 27: Adds comment from Cineplanet; Jan. 28: Includes additional comment from Cineplanet.<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>Now playing:<br>Watch this:<br><br>US and allies target encryption backdoors, Twitter speaks...<br><br><br><br><br><br><br>1:25<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>[#comments  Comments]<br><br><br><br><br><br><br><br><br><br><br><br><br><br>[/tags/hacking/ Hacking]<br><br>[/tags/privacy/ Privacy]<br><br><br><br>[/topics/security/  Notification on Notification off Security]