A publicly accessible, unprotected database belonging to car dealership marketing firm Dealer Leads was found to expose 198 million records, including personally identifiable information, Security Discovery reports.
The database contained 413GB of data representing a compilation of information on potential car buyers, vehicles, loan and finance inquiries, log data with IP addresses of visitors, and more.
With thousands of automotive sites, each specifically aimed at a precise buyer demographic or behavioral characteristic, Dealer Leads delivers content relevant and related to the auto industry or specific target keywords.
Founded in 2015 and based in Calabasas, California, Dealer Leads says it provides “high volume, high quality website traffic for franchise and independent car dealerships.”
The exposed database was set to be “open and visible in any browser,” meaning that anyone connected to the Internet could access the data without having to provide administrative credentials.
Security Discovery also revealed that the database contained records with name, email, phone, address, IP, and other sensitive or identifiable information, in plain text.
Information such as IP addresses, ports, pathways, and storage info, the security firm notes, could be exploited by cybercriminals to access deeper into an organization’s network.
The company restricted public access to the database immediately after being notified on the matter, but the data was exposed for an undetermined period of time, when anyone could have accessed the millions of records there.
“It is unclear if Dealer Leads has notified individuals, dealerships, or authorities about the data incident. Because of the size and scope of the network applicants and potential customers may not know if their data was exposed,” Security Discovery notes.
