CyberNews recently discovered that the digital marketing agency teamDigital was exposing multiple environment config files which contain sensitive data. By exposing this type of data, teamDigital is putting their own data and the data of their clients – big names like the NFL, Mastercard, Soundcloud, and more – at risk, potentially leading to ransomware, targeted phishing campaigns, and others.
An environment file (with a filetype .env) is the main configuration file of a web application that contains sensitive data needed for an application to work, including database credentials, email provider credentials, and API keys. For that reason, it should never be made publicly accessible or committed to a Git where it in some cases can be accessed by others.
Our researchers discovered three separate environment files that contained information to access teamDigital’s Mastercard, SMS tool, and FTP databases, including the League of Legends-related MasterCardNexus Twitter API keys, which would allow a cybercriminal to control much of that account.
We notified teamDigital of the exposed files immediately when we discovered them on October 9, 2020, and they reported to CyberNews that the issue was addressed the same day. A request for comment from teamDigital was not returned by the time of publishing.
Who is teamDigital?
These environment config files belong to the digital marketing agency teamDigital Promotions, Inc. located in Connecticut. Besides digital marketing, teamDigital also provides services related to legal compliance and administration, plus engagement solutions and platforms. According to teamDigital’s website, its clients include such top brands as:
NFL
MLB
Carnival Cruise Line
Mastercard
NASCAR
Xfinity
WNBA
Soundcloud
The 100-year-old clothing brand New York & Company
