GMO GlobalSign said on October 30 that a misconfiguration in its single sign-on service GMO Trust Login exposed the names, email addresses and other data of 45,030 people at 2,492 client companies. Customer files had been stored in the same public area used for logo images, leaving them retrievable from outside for about nine years.
The company traced the problem to November 14, 2017, when it moved storage to a public area to ease the load of delivering logo images. Files the system generated during bulk operations, and its own contract information files, were kept in that same area. Anyone who could see the file list could download individual files, and the links carried no signature or expiry date.
GMO GlobalSign judges that files could be fetched from outside from around November 14, 2017 until September 15 this year, when it blocked external access. It confirmed third-party retrieval in logs from June 8, 2021 onward. Earlier logs do not exist, so it could not establish whether files were taken before that date, but it included those records in the tally anyway.
How the leak was found
An outside security researcher reported the flaw through a vulnerability disclosure program on September 14. The company cut off all external file retrieval between that night and the following evening.
GMO GlobalSign ran regular diagnostics and penetration tests, but those covered applications and servers, not the storage where the files sat, so the exposure went unnoticed for years.
What was exposed
The files fell into two groups. The first were created by GMO GlobalSign's system when a client company's administrator used the admin screen for bulk operations: template and error files generated when an administrator set passwords on behalf of many users or registered custom attributes in bulk, plus error files from bulk member additions.
These contained email addresses, names, the names of linked services, and custom attribute values such as employee numbers and affiliations. They covered 44,836 people at 2,184 companies.
The second group were contract information files, holding company ID, license count, usage status, cancellation date, and the name, address, phone number and email address of the person designated to receive invoices. GMO GlobalSign did not explain how these files came to be stored in the public area. Invoice recipients' details were exposed at 217 companies, covering 194 people not already counted in the bulk-operation files. A further 91 companies could not be identified because administrator accounts had been deleted.
Login passwords, secret questions and answers, multi-factor authentication data, passwords for the individual services reached through single sign-on, and payment card details were not included.
Group company led the investigation
GMO Cybersecurity by Ierae, which GMO GlobalSign describes as an outside specialist organization, confirmed in its investigation that files had been retrieved by third parties. The company judges they may have been taken for malicious purposes. Ierae is part of the same GMO group.
The disclosure is the third report on the incident and follows the completion of that investigation. The number of affected people rose from the provisional figure given in the first report on September 16, after a follow-up investigation found files missing from the original scope and errors in the criteria used to judge which records were affected.
What changes
Download links now carry signatures and expire after one hour, and file lists can no longer be retrieved from outside in any storage location. Files that must be public, such as logo images, will be served only through a dedicated delivery system that accepts a fixed set of file types.
When new features that handle files are designed, staff will be required to check the type of data involved, where it is stored and how it is deleted. The company will also automatically check public areas for files that should not be there, and will widen specialist diagnostics to the whole cloud environment, running them twice a year.
Customer files will be deleted automatically after a retention period set for each data type. File-handling code will be consolidated into shared components that standardize storage location, access method and deletion procedure, and new features will be required to use them.