Cybersecurity investigators detected an unsecured database operated by a gymnasium chain called Town Sports International. This flaw resulted in some 600,00 user records being exposed. These records consisted of client data, such as data that is personally identifiable, as well as information relating to employees.
All told the data set included full names, street addresses, phone number, email addresses, last four digits of credit cards, credit card expiration dates, and billing history.
The database was apparently exposed on 30th November 2019 and not fully secured until 22nd September 2020. It remains that across the timeframe of concern it is unknown just how many records were exposed. What is known is that most of the data was held on standard office spreadsheets.
Looking at this issue for Digital Journal, Ben Goodman, SVP, Global Business and Corporate Development, ForgeRock explains the risks: “Unfortunately, this is not the first time a database was left unsecured on the web. This incident demonstrates how important it is for organizations to implement extra security precautions to ensure their users’ private data is truly safe, as unauthorized access is the number one attack method by cybercriminals in 2020.”
In terms of how such issues can be tackled, Goodman advises: “Institutions can leverage tools such as identity access management (IAM) to provide contextual, continuous security. This security measure will prompt further identity verification, such as 2FA or MFA, when an unauthorized user attempts to access a database. With an IAM system in place, organizations can ensure the safety of employee and customer data.”
