Supply chain β›“ Supply Chain

Tribune Media, Times Media Grup Third-Party Breach (September 2020)

πŸ“… 2020-09-01 🏒 View Media
Primary Source β†—

Incident Details

Online marketing company exposes 38+ million US citizen records. The user record files contained full names, addresses, zip codes, emails, and phone numbers of people based in the US. The CyberNews research team discovered an unsecured data bucket that belongs to View Media, an online marketing company. The bucket contains close to 39 million US user records, including their full names, email and street addresses, phone numbers and ZIP codes. The database was left on a publicly accessible Amazon Web Services (AWS) server, allowing anyone to access and download the data. Following the 350 million email leak covered by CyberNews earlier in August, this is the second time this summer we encountered an unsecured Amazon bucket containing such massive amounts of user data. Third-party company: View Media.

Technical Details

Initial Attack Vector
Compromise of third-party service provider / vendor relationship
Vendor / Product
View Media
Supply Chain Attack
βœ… Confirmed third-party / vendor compromise

Timeline

  1. 2020-09-01 Breach occurred
  2. 2020-09-03 Publicly disclosed