Thousands Of British Consultants and Firms Had Their Data Leaked Through 'CHS'

A breach of a database from several British consulting firms exposed detailed sensitive information belonging to the firms, along with thousands of British professionals, according to the research team at vpnMentor.

The files that were stored on Amazon Web Services (AWS) S3 bucket database labelled "CHS", include passport scans, job applications, and tax documents, addresses, extensive background checks, criminal records, expenses and benefits forms, paperwork related to business taxes and HMRC (HM Revenue and Customs), scanned contracts with signatures, salary details, private messages, and one contract for a loan.

Inside the database were files that could be dated back to 2011, with most coming from 2014 and 2015.

There were linked to now-defunct companies, including Dynamic Partners, Garraway Consultants, Partners Associates Ltd, and Winchester Ltd, as well companies that are still operating, like Eximius Consultants Limited and IQ Consulting.

In a blog post, vpnMentor said that:

According to vpnMentor, this incident could have easily avoided if they had taken some basic security measures to protect the database. These include, but are not limited to:

1. Securing their servers.
2. Implementing proper access rules.
3. Never leaving a system that doesn’t require authentication open to the internet.

Moreover, people should:

1. Make the bucket private and add authentication protocols.
2. Follow AWS access and authentication best practices.
3. Add more layers of protection to their S3 bucket.

"It’s important to note that open, publicly viewable S3 buckets are not a flaw of AWS. They’re usually the result of an error by the owner of the bucket," the researchers added.

Amazon secured or took the data offline, but the company would not reveal which company was responsible for the fault or who had accessed it. What this means, it's impossible to report the case to the Information Commissioner's Office, a UK public body responsible for data protection.

VpnMentor reported the data to the National Cyber Security Centre (NCSC), but the agency did not respond for a month because the email was sent to the NCSC's junk mail folder, say Noam Rotem and Ran Locar, who led this vpnMentor's research.

Such news is a reminder that, no matter how secure you keep your own information, companies still fail to do their due diligence. This most recent breach is "probably a combination of ignorance and a lack of accountability—they simply don't care," Rotem says.