A US government email server was discovered online without a proper password (opens in new tab) to protect its content, essentially leaking sensitive information to anyone who knew where to look. Whether or not anyone really knew where to look – remains to be seen.
The exposed email server was hosted on Microsoft’s Azure government cloud for Department of Defense, allowing it to share sensitive, but still unclassified data.
This service offers servers that are physically disconnected from commercial customers, and was part of an internal mailbox system that held some 3TB of internal military emails, some of which referred to U.S. Special Operations Command (USSOCOM), a military unit running special operations.
Terabytes of data
However it seems that the servier wasn’t protected with a password, so simply knowing the IP address would be enough to access it, and all of the data it hosted.
This hosted data reportedly included sensitive information such as internal military email messages, personal information and health information on certain government employees, and more.
The breach was spotted by security researcher Anurag Sen, who tipped off TechCrunch to the news so that it could alert the US government.
TechCrunch said it had seen some of the data hosted on the server and believes them to be unclassified, “which would be consistent with USSOCOM’s civilian network,” it argues.
The server was first listed as exposed on February 8, but there’s no explanation yet why it happened.
TechCrunch reached out to USSOCOM shortly after, with the server locked down the following day.
Responding to an email inquiry, USSOCOM spokesperson Ken McGraw said that the incident was not the result of a hack: “We can confirm at this point is no one hacked U.S. Special Operations Command’s information systems,” said McGraw.
Via: TechCrunch (opens in new tab)
