• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

CUSTOMER COMMENTARY

News About Finding & Keeping Customers

CUSTOMER COMMENTARY

News on Finding & Keeping Customers

  • HOME
  • CALL TRACKING
  • COMMUNICATIONS
  • EMAIL
  • MARKETING TECHNOLOGY
  • SOCIAL MEDIA
  • ABOUT/CONTACT

Sega left a huge database of user information open to hackers

by

Sega Europe could have easily fallen victim to a data breach as security researchers recently discovered that the company had left sensitive files stored insecurely on a publicly accessible database.

Researchers at the security firm VPN Overview found the files in question stored on a misconfigured Amazon Web Services (AWS) S3 bucket. They were also able to obtain multiple sets of AWS keys that gave them read and write access to Sega Europe’s cloud storage.

In addition to sensitive files, the misconfigured S3 bucket contained was also used to host websites for a number of popular Sega properties including Sonic the Hedgehog, Bayonetta, Football Manager and Total War as well as Sega’s official site. In total, 26 public-facing domains controlled by Sega Europe were affected.

VPN Overview’s researchers were able to upload files, execute scripts, alter existing web pages and modify the configuration of critically vulnerable Sega domains according to a new report.

Compromised email and cloud services

During its investigation, VPN Overview’s security team recovered an API to the email marketing software MailChimp that gave it the ability to send emails from the address donotreply@footballmanager.com.

The team then sent multiple messages to test its access and every email it sent appeared legitimate and also used TLS encryption. From here, the researchers were able to alter existing MailChimp templates and even create their own. As all of the emails sent out to Football Manager users appeared legitimate and would be able to bypass email security checks, a malicious attacker could have used this access to launch phishing campaigns.

VPN Overview was also able to upload and replace files on three of Sega’s content delivery networks (CDNs). As third-party websites often link to a company’s CDN for an official version of an image or file, 531 additional domains were linked to Sega Europe’s affected CDNs. As a result, an attacker could have abused the company’s CDNs to distribute malware and ransomware to unsuspecting users.

After discovering Sega Europe’s misconfigured S3 bucket, VPN Overview responsibly disclosed its findings to the company which then secured the database and all of its  affected cloud services and software.

We’ve also featured the best antivirus and best password manager

Originally Appeared Here

Filed Under: EMAIL

Primary Sidebar

Editor Picks

ZYWAVE NAMED AS FINALIST IN 2023 STEVIE® AWARDS FOR SALES & CUSTOMER SERVICE

Larimer County Begins Discussions with Republic Services on Landfill

Propelled by Product, Partner, and Market Momentum, Matillion

3 Takeaways from the 2022 Sola Salons Summit

Achieving a frictionless customer experience in fintech

Stay Competitive in the Waste and Recycling Industry

What You Should Know About Getting an MBA as a CPA

Adaptiva Named as Finalist in 2023 Stevie® Awards for Sales & Customer Service

Method Media Intelligence (MMI) Releases MAP-ACT

Digital Marketing Manager – Axios Charlotte

Copyright © 2023 Customer Commentary · Privacy Policy · Terms & Conditions · Log in

Terms and Conditions - Privacy Policy