CloudSEK Says Exposed Supplier Credentials Put Banking Systems and Customer Data at Risk
Summary
CloudSEK says exposed supplier credentials enabled access to a communications portal, 32 cloud accounts, call recordings and transcripts, and tools to message over 50,000 users. The company reports that its discovery enabled mitigation.
Key points
- CloudSEK says its SVigil platform found supplier employee credentials in a dark-web credential dump; the credentials enabled access to a communications portal used for banking-related operations.
- The portal exposed modules for campaigns, emergency notifications, reports, setup, and cloud accounts.
- CloudSEK reports credentials for 32 AWS, GCP, and Azure accounts were accessible, including GCP service accounts with elevated Owner or Editor roles.
- Exposed cloud storage contained sensitive call recordings and plain-text transcripts, including loan discussions and debit card block requests.
- Portal access could allow changes to contact-center operations and bulk SMS or email to more than 50,000 users.
- The article says the supplier portal lacked MFA and that EDR did not detect abnormal access; CloudSEK recommends revoking exposed credentials, tightening cloud permissions, and enforcing MFA.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- Unauthorized access using exposed employee credentials, with exposure of customer data and cloud infrastructure
- Data Types Exposed
- Customer data
- Call recordings
- Call transcripts
- Cloud service account credentials and configuration files
- Operational Impact
- The article reports unauthorized access to the supplier portal and cloud accounts. It describes risks of operational disruption, data theft, infrastructure tampering, and unauthorized customer communications, but does not report that these impacts occurred.
- Claim Status
- confirmed