Global Document Translation Service Exposed Highly Sensitive Records Online
Syndicated By: Iain Fraser - Cybersecurity Journalist Gibraltar
10th July 2023
Recently, security researcher Jeremiah Fowler discovered and reported to WebsitePlanet a non-password protected database containing more than 25k records. The publicly exposed documents included highly sensitive files, which contained personally identifiable information (PII).
The unsecured database contained internal screenshots of source code as well as customer documents that were stored in uploads folders. These documents include: US Federal and State tax filings, passports, driver licenses, birth and marriage records, business documents, denied visa petitions, among other files from customers around the world. Upon further research, there were references and invoices linked to a NYC-based translation service provider, Kings of Translation. The company offers translation services and claims to have locations in the UK and Latvia. The database contained a total of 25,601 records. Kings of Translation purportedly used its own technology to let customers upload their documents and pay for the order automatically. I immediately sent a responsible disclosure notice to Kings of Translation. Despite receiving no response, I noted that public access to the database was restricted the following day.
People usually don’t consider how paper documents offline can become an online data risk, but this discovery proves that even those documents can be compromised. In my years as a security researcher, I have seen all types of documents and data breaches from a wide range of industries, organizations, and businesses, and this is the first time I have found the data of a translation service and its customers. However, I have never seen such a wide range of documents in a single database before. Some businesses handle more sensitive records than others, and usually the documents they collect and store are related to their specific business or industry. Documents that need to be translated are often of significant importance and may be required by foreign governments or educational institutions, or for acquiring crucial records such as birth, marriage, divorce, death certificates, among others. Learn More /...
About Jeremiah Fowler
Jeremiah Fowler is a Security Researcher and co-founder of Security Discovery. Jeremiah began his career in security research in 2015 and has a mission of data protection. He has helped identify and secure the data of millions of people around the world. His discoveries have been covered in Forbes, BBC, Gizmodo, among others. Security and responsible disclosure are not only a passion, but a way of protecting our digital lives. Learn More /...
