A third-party MongoDB database containing 2.8 million CenturyLink customer records and information was left unprotected exposing the data of several hundred thousand of the tech company’s customers.
The database
was found by the security firm Comparitech working with security researcher Bob
Diachenko. The initial finding took place on September 15, but it is believed
the information had been exposed on the internet for about 10 months, Comparitech
reported.
CenturyLink said in a statement sent to Comparitech that “The data involved appears to be primarily contact information and we do not have reason to believe that any financial or other sensitive information was compromised. CenturyLink is in the process of communicating with the affected customers.”
The information
contained included name, email address, phone number, home address, CenturyLink
account number, notification logs and conversation logs.
CenturyLink was immediately alerted to the problem and the database was locked down by September 17.
“After
alerting CenturyLink and allowing them time to resolve this issue, they
requested we hold off on publishing this report. This was to allow time for
CenturyLink to conduct an internal investigation and refer the matter to the
FCC before notifying their customers,” Comparitech said.
Want to read more?
Next post in Data Breach
