Millions of call logs and SMS text messages have been found exposed on a misconfigured database belonging to “voice over internet protocol” provider VOIPo LLC.

Discovered by Cloudflare Inc. security researcher Justin Paine, the data was spotted via the Shodan security search engine and traced back to an unsecured Elasticsearch server owned by VOIPo.

The data included 7 million call logs, 7 million SMS/MMS message logs and plaintext internal system credentials, including unencrypted passwords.  The database is said to have been exposed since June 2018 and contained call and message logs dating back to May 2015.

The breach was confirmed by VOIPo. In a notice, the company said the data was mostly simulated data located on an isolated development server and that its production environment and the rest of its network was “not at risk.”

Ruchika Mishra, director of products and solutions at Balbix Inc., told SiliconANGLE that the millions of exposed call logs, text messages and other internal documents containing unencrypted passwords make victims easy targets for hackers.

“Although VOIPo claims there is no evidence to indicate a breach occurred, the company cannot guarantee that no unauthorized users accessed the data, especially since it was left unsecured and easily available for months,” he said. “Voipo and its customers might still be secure if the company had early visibility into vulnerabilities across its entire attack surface — including passwords and unencrypted data — and been able to correct them right away.”

Stephan Chenette, co-founder and chief technology officer of AttackIQ Inc., noted that it doesn’t take much for outsiders to find unsecured databases and access sensitive information.

“Misconfigured security controls are an all-too-common problem,” Chenette noted. “Organizations are increasingly struggling with limited and undertrained IT resources that lead to using default account passwords, unpatched systems, and poorly configured network devices.”

Data leaks of any kind can undermine customer confidence, but they’re easily preventable, he said. “Unauthorized exposure of any type of customer data, for any period, is a serious issue and organizations should always have a plan to continuously assess the viability of their security controls.”

Photo: US Air Force