ApexSMS – 23.2 M Accounts Exposed via Unsecured MongoDB Instance
What Happened – In May 2019 a publicly accessible MongoDB server named ApexSMS was discovered without authentication. The mis‑configured database contained over 80 million records, including 23 million unique email addresses, names, phone numbers, carrier information, geographic locations, genders and IP addresses. The data was subsequently scraped and added to the Have I Been Pwned breach catalog.
Why It Matters for Trust & Control Assurance
- Unauthenticated database exposure is a classic control‑gap that a continuous control‑assurance program should detect, document and remediate before data is harvested.
- Demonstrating that configuration controls are continuously monitored provides defensible evidence for audits and reduces the likelihood of large‑scale data‑exposure findings.
- Mapping this incident to the “Secure Configuration Management” control objective shows how one control can satisfy multiple framework requirements (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Organizations that rely on SMS gateways, telecom carriers, marketing platforms, and any business that stores customer contact data in cloud‑hosted databases.
Recommended Actions
- Inventory all cloud‑based data stores and verify that authentication is enforced.
- Enable encryption at rest and in transit for any database containing personal data.
- Deploy continuous configuration‑monitoring tools that generate immutable evidence of secure settings.
- Conduct a post‑incident audit to map the gap to your control framework and update remediation tickets.
Source: Have I Been Pwned – ApexSMS breach
Technical Notes
- Attack vector: Unprotected MongoDB instance (misconfiguration).
- Data types exposed: Email addresses, names, phone numbers, carrier info, gender, geographic location, IP address.
- Underlying cause: Default‑open database configuration, lack of network segmentation, no access controls.
Source: Same as above