Two AI App Breaches Expose 1 Billion Private KYC Records, Reports Say

Data breach involving AI apps
Data breaches impact millions of users worldwide
 
<hr class="hr"/>

<span class="subtitle">Overview of Recent Breaches</span>
<p class="content">Recent discoveries by cybersecurity experts have highlighted two significant data breaches tied to artificial intelligence (AI) applications, compromising sensitive user data and media files of millions globally. As reported by <em>Cybernews</em>, these incidents could potentially expose over one billion records. The first breach is associated with IDMerit, a provider of AI-driven Know Your Customer (KYC) tools used for digital identity verification in the fintech sector.</p>

<div>
    <div class="event-card">

        <h3>IDMerit Data Breach Impact</h3>

        <p class="content">The IDMerit breach has revealed around one billion sensitive personal records from individuals across 26 nations. The United States experienced the most significant impact, with over 203 million compromised records, followed closely by Mexico at 124 million and the Philippines at 72 million. The leaked information encompasses critical identifying factors, including full names, addresses, dates of birth, national identification numbers, phone numbers, genders, email addresses, and telecommunications metadata.</p>

    </div>

    <div class="event-card">

        <h3>Potential Consequences of the Breach</h3>

        <p class="content">Experts have cautioned that the ramifications of this data breach could include account takeovers, targeted phishing attacks, credit fraud, SIM swapping, and long-term privacy violations. They emphasize that automated web scrapers employed by cybercriminals continuously monitor for exposed data instances, promptly harvesting them as they surface.</p>

    </div>

    <div class="event-card">

        <h3>Second Breach: 'Video AI Art Generator'</h3>

        <p class="content">The second incident involves the "Video AI Art Generator &amp; Maker," an Android application that has garnered over 500,000 downloads on Google Play and holds a 4.3-star rating based on more than 11,000 reviews. This app was found to be leaking user data due to a misconfigured Google Cloud Storage bucket, inadvertently allowing unrestricted access to stored files.</p>

    </div>

    <div class="event-card">

        <h3>Extent of Data Exposure</h3>

        <p class="content">The aforementioned misconfigured bucket led to over 1.5 million leaked user images, 385,000 videos, and millions of media files generated by users through the app. This bucket contained approximately 8.27 million media files, totaling over 12 terabytes of data. The exposure included every file uploaded since the app's launch on June 13, 2023.</p>

    </div>
</div>

/ Cybersecurity Overview and Analysis /
In analyzing these incidents, it’s evident that initial access tactics might include exploiting misconfigurations and inadequate security measures. The lack of proper authentication in the “Video AI Art Generator” breach highlights a vulnerability that could fall under the MITRE ATT&CK tactic of “Initial Access.” The IDMerit breach reinforces the potential for wide-reaching impact from breaches involving personal identifiers, indicating how essential it is for organizations to maintain robust cybersecurity protocols against such threats. Business owners must prioritize their data security strategies to mitigate the risks presented by these evolving cyber threats.

Source link

Related Posts