{"id":14414,"date":"2019-03-11T17:15:19","date_gmt":"2019-03-11T17:15:19","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/dozens-of-companies-leaked-sensitive-data-thanks-to-misconfigured-box-accounts.html"},"modified":"2019-03-11T17:15:19","modified_gmt":"2019-03-11T17:15:19","slug":"dozens-of-companies-leaked-sensitive-data-thanks-to-misconfigured-box-accounts","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/dozens-of-companies-leaked-sensitive-data-thanks-to-misconfigured-box-accounts.html","title":{"rendered":"Dozens of companies leaked sensitive data thanks to misconfigured Box accounts"},"content":{"rendered":"

Security researchers have found dozens of companies inadvertently leaking sensitive corporate and customer data because staff are sharing public links to files in their Box <\/a> enterprise storage accounts that can easily be discovered.<\/p>\n

The discoveries were made by Adversis, a cybersecurity firm, which found major tech companies and corporate giants had left data inadvertently exposed. Although data stored in Box enterprise accounts is private by default, users can share files and folders with anyone, making data publicly accessible with a single link. But Adversis said these secret links can be discovered by others. Using a script to scan for and enumerate Box accounts with lists of company names and wildcard searches, Adversis found more than 90 companies with publicly accessible folders.<\/p>\n

Not even Box\u2019s own staff were immune from leaking data.<\/p>\n

The company said while much of the data is legitimately public and\u00a0Box advises users<\/a> how to minimize risks, many employees may not know the sensitive data they share can be found by others.<\/p>\n

Worse, some public folders were scraped and indexed by search engines, making the data found more easily.<\/p>\n

In a blog post<\/a>, Adversis said Box administrators should reconfigure the default access for shared links to \u201cpeople in your company\u201d to reduce accidental exposure of data to the public.<\/p>\n

Adversis said it found passport photos, bank account and Social Security numbers, passwords, employee lists, financial data like invoices and receipts and customer data among the data found. The company contacted Box to warn of the larger exposures of sensitive data, but noted that there was little overall improvement six months after its initial disclosure.<\/p>\n

\u201cThere is simply too much out there and not enough time to resolve each individually,\u201d he said.<\/p>\n

Adversis provided TechCrunch with a list of known exposed Box accounts. We contacted several of the big companies named, as well as those known to have highly sensitive data, including:<\/p>\n