Full Report
Unsecured public-facing database allowed anyone to access ID selfies for months
Analysis Summary
# Incident Report: Unsecured Brazilian ID Verification Database
## Executive Summary
An unsecured, public-facing Elasticsearch database was discovered containing over 100,000 highly sensitive documents, including "ID selfies" and scans of official identity documents belonging to Brazilian citizens. The exposure resulted from a misconfigured server that lacked authentication, allowing anyone with the IP address to access and download the contents. Upon discovery by Group-IB, the server was taken offline by Brazilian authorities within 10 hours to prevent further unauthorized access.
## Incident Details
- **Discovery Date:** Not explicitly stated (Reported as "Recently" by Group-IB)
- **Incident Date:** Exposed for several months prior to discovery
- **Affected Organization:** Not disclosed (Likely a third-party identity verification provider)
- **Sector:** Identity Verification / Technology
- **Geography:** Brazil
## Timeline of Events
### Initial Access
- **Date/Time:** Months prior to discovery
- **Vector:** Misconfigured Cloud Database
- **Details:** An Elasticsearch database was left exposed to the public internet without password protection or authentication mechanisms.
### Lateral Movement
- **N/A:** The incident involved direct access to a data store; no lateral movement through a corporate network was reported.
### Data Exfiltration/Impact
- **Data Exposed:** Over 100,000 files including:
- "Selfies" of individuals holding their ID cards.
- Scans of Brazilian ID cards (RG).
- Scans of Brazilian Driver’s Licenses (CNH).
- **Volume:** Unknown total gigabytes, but verified at 100,000+ individual records.
### Detection & Response
- **Discovery:** Identified by Group-IB during proactive internet scanning for unsecured databases.
- **Response Actions:** Group-IB's CERT-GIB notified Brazilian cybersecurity authorities. The server was successfully taken offline within 10 hours of the notification.
## Attack Methodology
- **Initial Access:** Exploitation of public-facing, unauthenticated Elasticsearch instance.
- **Persistence:** Not applicable (Data was static and publicly accessible).
- **Privilege Escalation:** None required due to lack of authentication.
- **Defense Evasion:** None; the server was completely open.
- **Credential Access:** None required.
- **Discovery:** Automated internet scanning (Shadow IT/Attack Surface discovery).
- **Collection:** Direct querying of the Elasticsearch API.
- **Exfiltration:** Standard HTTP/HTTPS data transfer.
- **Impact:** Massive exposure of Personally Identifiable Information (PII) and Know Your Customer (KYC) data.
## Impact Assessment
- **Financial:** High potential for fraud and identity theft costs; possible regulatory fines under LGPD (Brazilian General Data Protection Law).
- **Data Breach:** High-sensitivity PII (Biometric selfies and government ID numbers).
- **Operational:** Service disruption as the database was taken offline for remediation.
- **Reputational:** Significant damage to the affected organization's trust regarding their handling of sensitive KYC data.
## Indicators of Compromise
- **Network Indicators:** Publicly accessible Elasticsearch port (typically 9200/9300) on a Brazilian IP address [Defanged: XXX[.]XXX[.]XXX[.]XXX:9200].
- **Behavioral Indicators:** Unusually high outbound traffic to unknown IPs (if scraped by malicious actors).
## Response Actions
- **Containment:** Notification sent to Brazilian CERT.
- **Eradication:** The server was decommissioned/taken offline by authorities.
- **Recovery:** Investigation launched to identify the owner and notify affected data subjects (ongoing).
## Lessons Learned
- **Visibility:** Organizations often lack visibility into their "Shadow IT" or third-party vendor storage buckets.
- **Security by Design:** ID verification services handle the most sensitive form of PII and must implement mandatory authentication and encryption at rest.
- **Scanning:** Proactive scanning by security researchers (and attackers) will inevitably find open databases.
## Recommendations
- **Access Control:** Implement strict Identity and Access Management (IAM) policies; never expose database ports directly to the internet.
- **Encryption:** Encrypt all PII at the application level before it reaches the database.
- **Automation:** Use Cloud Security Posture Management (CSPM) tools to automatically detect and remediate unencrypted or public-facing data stores.
- **Vendor Risk Management:** Audit third-party identity verification partners to ensure they follow strict data handling protocols.