Carla car rental data exposed in unsecured AWS bucket

Coverage from Tech Radar indicates that the car rental comparison and booking platform Carla had a database containing sensitive customer information exposed on the open internet. Cybersecurity researchers from Cybernews discovered an unsecured Amazon Web Services (AWS) bucket containing approximately 48,000 PDF files with customer rental data.

The exposed files, identified as belonging to Carla, contained personal information of drivers including names, email addresses, phone numbers, rental details, confirmation numbers, and travel patterns. Cybernews noted that this data could be exploited for sophisticated phishing attacks, using travel patterns to build trust with victims.

After being notified, Carla secured the database. While there is currently no evidence of malicious access, the risk remains as automated tools could have discovered the unsecured data. This incident highlights the ongoing issue of misconfigured databases and the importance of understanding cloud security responsibilities. Cybernews also recently reported a similar exposure involving Nextcloud, which leaked employee and client data.

Source: Tech Radar