Pierluigi Paganini
May 13, 2023
The Cybernews research team has discovered a data leak on La Malle Postale’s system that exposed the personal data of their clients. The leaked information included names, phone numbers, emails, private communication via SMS messages, passwords, and employees’ credentials.
Founded in 2009, the company provides luggage and passenger transportation services on many popular hiking routes, including the famous Santiago de Compostela pilgrimage trail. The services are well-reviewed by their clients, with an overall four-star rating on TripAdvisor.
Leaked personal data
On January 11th, the Cybernews research team found a publicly accessible datastore with more than 4GB of personal data belonging to the company’s clients.
The leaked personal data included names, emails, and phone numbers of nearly 90,000 customers. The datastore also included more than 13,000 SMS messages sent between the company and its customers.
Researchers also stumbled upon 70,000 customer credentials. Although leaked passwords were not in plain text, they were hashed using the easily crackable WordPress MD5/phpass hashing algorithm.
The exposure of emails and passwords is dangerous, as malicious actors could use them for credential stuffing to try to access other accounts the victim might be using.
The discovered datastore also included the company’s drivers and admin credentials—their emails, passwords, salts used for securing passwords, and authentication tokens.
The employee passwords were left vulnerable to cracking, as they were encoded using the Base64 algorithm. Encoded data can be reversed or decoded back to its original format, so encoding should not be used for storing passwords.
Leaking employee credentials might put the company at risk of targeted cyberattacks. Threat actors could exploit the data to gain access to the company’s network and steal sensitive information.
Cybernews tried several times to reach out to the company but at the time of writing has received no reply. According to Cybernews researchers, the access to the datastore was secured at the end of April.
Why is leaking personal data dangerous?
Leaked customer names, emails, phone numbers, and private communication between clients and the company introduces the risk of various cyberattacks.
One of them is identity theft. Fraudsters may exploit the exposed personal information to impersonate the affected individuals and gain access to their financial accounts or other sensitive information. Additionally, criminals could use the data to apply for loans or credit cards in the name of the affected individuals.
Leaked data might also lead to phishing scams. Customers’ personal information might be utilized to craft targeted phishing emails that appear credible and thus increase the likelihood that the recipients will fall for the scam.
Threat actors might also exploit La Malle Postale’s credibility among its clients in social engineering attacks. Criminals might try calling individuals and pretending to be representatives of the company to gain access to sensitive information.
Are you interested in knowing the steps that should affected customers take?
Give a look at the original post at
https://cybernews.com/security/la-malle-postale-data-leak/
About the author: Paulina Okunytė, Journalist at CyberNews
We are in the final!
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini
Please nominate Security Affairs as your favorite blog.
Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, La Malle Postale)
