Actor Claims Public BudBoard Bucket Exposed Client Data and Production POS Key
Summary
An actor posting as exfilar claims a publicly readable BudBoard bucket exposed database exports, staff and client data, and a screenshot of a production POS API key. The claim is unverified.
Key points
- An actor posting as exfilar alleges BudBoard left a cloud storage bucket publicly readable without authentication.
- The bucket reportedly contained two 2024 database exports and data for 58 staff accounts.
- Information associated with 18 dispensary and brand clients in the United States, Canada, and Australia was allegedly exposed.
- A screenshot reportedly showed a production API key for a major cannabis POS platform; its validity is unknown.
- The claim remains unverified, including the report that the alleged exposure was still live.
Article Details
- Victim Organization
- BudBoard
- Incident Type
- Alleged public exposure of a cloud storage bucket containing database exports and sensitive data and configuration details.
- Data Types Exposed
- Database exports
- Staff account data
- Client data
- Sensitive configuration details
- Screenshot of a production POS API key
- Affected Records
- Data for 58 staff accounts and information tied to 18 dispensary and brand clients; the exact number of individual records is not specified.
- Operational Impact
- The post described the alleged exposure as still live. The production POS API key could affect downstream retail systems if valid; the claim remains unverified.
- Claim Status
- claimed
Countries
AustraliaInformation tied to 18 dispensary and brand clients in the United States, Canada, and Australia may have been exposed.CanadaInformation tied to 18 dispensary and brand clients in the United States, Canada, and Australia may have been exposed.United StatesInformation tied to 18 dispensary and brand clients in the United States, Canada, and Australia may have been exposed.