Jeremiah Fowler, discovered and reported to Website Planet about an unencrypted and non-password-protected database that contained 170,360 records with a total size of 116.24GB. Fowler reports:
In a limited sampling of the exposed documents, I saw spreadsheets detailing motel-employees’ PII, including names, physical addresses, email addresses, DOB, and SSN in plain text. The database also showed property inspection reports, notices to vacate (evictions), employee terminations and demotion letters, petty cash statements, receipts, and expense reports (some of which contain the card type used to pay and its last 4 digits). I also came across:
- Police reports including arrest details of guests and hotel employees.
- Documentation of accidents and falls, including images or videos of guests and employees on the ground.
- Proof of illness documents indicating positive COVID-19 tests and other medical issues.
- Images of damage done to rooms, common areas, and parking lots.
Fowler reports that although the data appear to belong to Income Property Investments Inc., he could not determine whether they are responsible for the data storage misconfiguration or if a vendor handles their data storage and security for them.
Read more about this data leak at Website Planet.
