ERP Provider Exposes 769 Million Records, Including API Keys And Email Addresses

Threat Actor: Unknown | unknown
Victim: ClickBalance | ClickBalance
Price: Not applicable
Exfiltrated Data Type: Sensitive information including API keys, email addresses, and bank account numbers

Key Points :

  • A massive data breach exposed 769,333,246 records from ClickBalance, a leading ERP provider in Mexico.
  • The exposed database was non-password-protected and contained 395 GB of data.
  • Data included access tokens, API keys, secret keys, bank account numbers, tax identification numbers, and over 381,000 email addresses.
  • The breach was discovered by cybersecurity researcher Jeremiah Fowler, who reported it to Website Planet.
  • ClickBalance provides cloud-based business services for automating administration, accounting, inventory, and payroll processes.
  • The exposure poses risks such as unauthorized access to systems, increased phishing attacks, and potential network vulnerabilities.
  • Recommendations for affected individuals include changing passwords, enabling two-factor authentication, and enhancing data security measures.
  • This incident highlights the data protection challenges faced by technology companies managing sensitive information.
ERP Provider Exposes 769 Million Records, Including API Keys And Email Addresses

A massive data breach involving ClickBalance, one of Mexico’s largest Enterprise Resource Planning (ERP) technology providers, has been uncovered by cybersecurity researcher Jeremiah Fowler.

The breach exposed a staggering 769,333,246 records, totaling 395 GB of data, in a non-password-protected database.

EHA

The exposed database contained potentially sensitive information, including:

  • Access tokens and API keys
  • Secret keys
  • Bank account numbers
  • Tax identification numbers
  • 381,224 email addresses

ClickBalance offers cloud-based business services for automating administration, accounting, inventory, and payroll processes. The company’s ERP software is designed to centralize data and provide real-time information on various business operations.

Fowler discovered the unprotected database and promptly reported it to Website Planet. Within hours of being notified, ClickBalance restricted public access to the database.

However, it remains unclear how long the data was exposed or if any unauthorized parties accessed it.

The exposure of such sensitive data poses several significant risks:

  • Unauthorized Access: The leaked API keys and secret keys could potentially grant cybercriminals access to critical systems and sensitive data.
  • Phishing Attacks: With over 381,000 exposed email addresses, there is an increased risk of targeted phishing attacks. According to Deloitte, 91% of all cyberattacks begin with a phishing email.
  • Network Vulnerabilities: Exposed IP addresses could serve as a starting point for cybercriminals to identify and exploit network vulnerabilities.

Recommendations

In light of this breach, affected individuals and organizations should take the following precautions:

  • Change passwords to new, complex ones
  • Enable two-factor authentication (2FA) on accounts
  • Be cautious of unsolicited emails or suspicious information requests
  • Implement incident response protocols
  • Notify affected stakeholders, customers, and partners
  • Enhance data security measures
  • Conduct regular security audits

This incident highlights the significant data protection challenges faced by technology companies managing large amounts of sensitive information.

ERP, CRM, and CDM systems are particularly vulnerable due to the vast array of data they store for multiple customers.

As these systems continue to play a crucial role in modern business operations, providers must prioritize data security to maintain trust and protect their clients’ sensitive information.

While the full extent of the breach’s impact remains unknown, this incident underscores the need for constant vigilance and proactive security measures in an increasingly digital business landscape.

Source: Original Post