Oh look! Another data-leak, this was was pretty bad as it contained plain-text passwords (who on earth doesn’t hash their passwords in the DB in 2011?!).<\/p>\n
Anyway this time it was a Groupon subsidary – Sosata.com<\/a> which managed to leak the e-mail addresses and plain-text passwords for 300,000 users AND on top of that, Google managed to index it.<\/p>\n The original story was published here:<\/p>\n Groupon leaks entire Indian user database<\/a><\/p>\n The leak was discovered by Australian security consultant Daniel Grzelak<\/a>.<\/p>\n Groupon subsidiary Sosasta.com accidentally published a database containing the email addresses and clear-text passwords of 300,000 users and the cache was indexed by Google.<\/p>\n The trove of personal data was discovered by Australian security consultant Daniel Grzelak as he plugged a handful of query terms into the search engine, he said Tuesday. He contacted Patrick Gray with security blog Risky Biz, which reported that the SQL database contained the details for 300,000 Sosasta account holders.<\/p>\n A Groupon spokesman confirmed that the digital coupon distributor \u201cwas alerted to a security issue\u201d on Thursday night and corrected the problem immediately. The issue was limited to Sosasta, which uses its own servers and network and isn’t connected to Groupon’s systems in other countries.<\/p>\n \u201cWe have begun notifying our subscribers and advising them to change their Sosasta passwords as soon as possible,\u201d the spokesman said in a statement. \u201cWe will keep our Indian subscribers fully informed as we learn more.\u201d<\/p><\/blockquote>\n At least this time it seems like someone messed up rather than a hack by LulzSec or Anonymous<\/a>. And it’s good to see an organization react quickly and responsibly to such an information disclosure, this is sadly a rather rare attribute.<\/p>\n The issue was limited to Sosata and did not effect any Groupon sites in other countries. Sosata users have been notified to change their passwords in the system, and I hope for their sakes not too much password re-use is going on.<\/p>\n I still don’t see the fact that the passwords were un-hashed being addressed anywhere though, doesn’t that concern anyone other than me?<\/p>\n