cyber.hendryadrian.com
Cyber Attack & Data Breach · cloudsek.com

Exposed Git Repository Leaks Vendor Source Code, Credentials and Automotive Customer Data

· Original article ↗

Summary

CloudSEK reports that a vendor’s publicly accessible .git repository exposed over 20 GB of source code, credentials, customer and merchant PII, and financial documents linked to automotive services in India.

Key points

  • A misconfigured .git folder on two vendor subdomains was publicly accessible; the article says its contents could be retrieved with a tool such as Git Dumper.
  • The exposure included over 20 GB of data, including internal e-portal source code and hardcoded email, SMS, payment gateway, and cloud database credentials.
  • Data related to more than 6,700 vehicle merchants and their customers was exposed, including names, addresses, mobile numbers, and vehicle details.
  • Exposed documents included thousands of cancelled cheques, tax certificates, and registration records, plus more than 2,000 PAN cards and dealer photographs.
  • CloudSEK says its SVigil platform identified the exposure and that discovery occurred before malicious actors found it; the article does not detail remediation steps taken by the vendor.

Article Details

Victim Organization
Not disclosed
Victim Domain
Not disclosed
Incident Type
Publicly accessible .git repositories exposed source code, credentials, customer and merchant personal information, and financial documents.
Data Types Exposed
  • Source code and revision history
  • Email (SMTP) credentials
  • SMS gateway secrets
  • Payment gateway tokens
  • Cloud database credentials
  • Customer names, addresses, mobile numbers, and vehicle details
  • Cancelled cheques
  • Service tax certificates
  • Official registration documents
  • PAN cards
  • Dealer photographs
  • Financial records and billing logs
Affected Records
Data belonging to over 6,700 vehicle merchants and their customers; the source also reports over 6,000 scanned cancelled cheques, 6,000 service tax certificates, 6,000 registration documents, and over 2,000 PAN cards.
Affected Data Size
Over 20 GB
Operational Impact
The exposed repositories and credentials created risks of phishing, impersonation, unauthorized transactions, database compromise, identity fraud, and business disruption. CloudSEK says SVigil identified the exposure before malicious actors did and prevented broader system abuse; the article does not report confirmed exploitation.
Ransom Or Extortion
None reported
Claim Status
confirmed

Vendors

CloudSEKCloudSEK’s Supply Chain Security platform, SVigil, uncovered a severe misconfiguration in the development infrastructure of a leading roadside assistance and insurance support service provider. This vendor works with

Products

SVigilCloudSEK’s Supply Chain Security platform, SVigil, uncovered a severe misconfiguration in the development infrastructure of a leading roadside assistance and insurance support service provider. This vendor works with

Tools

Git Dumperflaw required no sophisticated hacking. An attacker could utilize a readily available tool, such as Git Dumper, to retrieve the git object and decompress it into individual files. This simple action would clone the

Countries

IndiaThis vendor works with major automotive manufacturers, dealerships, and insurance companies across India, managing sensitive customer and merchant data for thousands of vehicle-related service requests each

Industries

Automotiveof a leading roadside assistance and insurance support service provider. This vendor works with major automotive manufacturers, dealerships, and insurance companies across India, managing sensitive customer andInsurancea severe misconfiguration in the development infrastructure of a leading roadside assistance and insurance support service provider. This vendor works with major automotive manufacturers, dealerships, andRoadside assistanceSVigil, uncovered a severe misconfiguration in the development infrastructure of a leading roadside assistance and insurance support service provider. This vendor works with major automotive manufacturers,