Dead retailer’s ‘customer data’ turns up on seized kit, unencrypted and very much for sale

Infosec bod claims he glimpsed sensitive personal info left on unwiped servers

For sale … NCIX’s flogged-off hardware (Credit: Travis Doering)

Servers that once belonged to defunct Canadian gadget retailer NCIX turned up on the second-hand market without being wiped – and their customer data sold overseas – it is claimed.

Those boxes, allegedly, stored plaintext credit card data for approximately 260,000 people, and purchase records for 385,000 shoppers.

Travis Doering, of infosec shop Privacy Fly, claimed he discovered the security cockup in the simplest way possible: he spotted the machines advertised on Craigslist, answered the ad, and inspected what was on offer.

According to the security consultant in a writeup this week, the hardware haul turned out to be 18 Dell Poweredge boxes from NCIX’s server farm, plus storage kit, and 300 desktop machines. They were seized by the retailer’s landlords after NCIX failed to pay CA$150,000 in rent, and sold off via auction to another person, who then apparently hawked the equipment to interested buyers via Craigslist last month.

The chain’s database files, dating back to 2007, were unencrypted on the machines, and covered all aspects of the business, according to Doering:

Other database tables contained millions of records created through the entire life of NCIX, we’re told. Customers in the databases lived in the US as well as Canada, it was claimed.

Infosec world and US Army veteran Jake Williams described it as “one of the most egregious data breaches ever”…

This is one of the most eggregious data breaches ever and highlights #supplyChain risk. Vendor stops paying rent, warehouse seizes servers and sells them (with data) unaltered. Millions of records, including plaintext passwords, already sold. Wow.https://t.co/Ai8NU2KnCO

— Jake Williams (@MalwareJake) September 20, 2018

The contact offering the kit for sale, known only as “Jeff,” also explained that he’d sold NCIX data to more than one overseas customer: $15,000 got each buyer “thirteen terabytes of SQL databases and various VHD and Xen server backup files,” it was alleged.

“I cringed at the thought of that data being sold once, as it was dangerous enough. Then during further conversation, Jeff mentioned at least five other buyers,” Doering claimed. “Jeff described one as a competing retailer, while the other three Jeff claimed to ‘not want to know’ their intentions or business.”

Doering noted that the straightforward measure of turning on full-disk encryption would have sufficed to prevent any leak. Alternatively, destroying the storage beyond salvage would have been a good move, in our view.

Since NCIX is nothing but a corpse now, those whose privacy has been breached – any customer or employee – have little chance for any redress, we fear. ®

Sponsored: Following Bottomline’s journey to the Hybrid Cloud