Data leak ⛓ Supply Chain

Verizon Customer Data Exposure via NICE Systems — 14 Million Records on AWS S3

📅 2017-06-01 🏢 NICE Systems AWS S3 bucket (Verizon customer data)
Primary Source ↗

Incident Details

In July 2017, UpGuard security researchers discovered that NICE Systems — an enterprise software company contracted by Verizon to manage call center quality assurance — had left an Amazon S3 bucket containing approximately 14 million Verizon customer records publicly accessible without authentication. The bucket contained records from Verizon’s customer call center operations, apparently collected and stored by NICE Systems as part of call monitoring and quality assurance services. Exposed data included names, addresses, account numbers, PIN codes (used for account authentication), and call recordings metadata. The exposure was particularly serious because PINs could be used to bypass Verizon’s customer service authentication and take over accounts. UpGuard notified Verizon, which worked with NICE Systems to secure the bucket. Verizon confirmed the exposure but disputed the scope, stating approximately 6 million customers were affected and that PINs were stored in encrypted form for some records. NICE Systems was contracted specifically to handle call center data — making this a third-party data handling breach consistent with growing supply chain risk in telecom customer service outsourcing. The incident occurred during growing attention to S3 misconfiguration breaches, which affected numerous major companies in 2017-2018 including Dow Jones, Booz Allen Hamilton, and the Pentagon.

Technical Details

Initial Attack Vector
NICE Systems — an Israel-based enterprise software company contracted by Verizon for call center quality improvement — misconfigured an Amazon S3 bucket to be publicly accessible; the bucket contained customer account data from Verizon's customer call center operations
Vendor / Product
NICE Systems AWS S3 bucket (Verizon customer data)
Supply Chain Attack
✅ Confirmed third-party / vendor compromise

Timeline

  1. 2017-06-01 Breach occurred
  2. 2017-07-12 Publicly disclosed
  3. 2017-07-12 Customers notified