Intelimost Exposes Over 3 Million Email Addresses and Passwords via Misconfigured Elasticsearch
What Happened — In March 2019 security researcher Bob Diachenko discovered an unsecured Elasticsearch database owned by Intelimost. The index contained 3,073,409 unique email addresses together with the plaintext passwords used to access the victims’ mailboxes.
Why It Matters for Trust & Control Assurance
- The breach is a textbook example of a cloud‑misconfiguration that a continuous control‑assurance program is built to detect and evidence.
- Mapping this incident to the control objective “Secure configuration and access control of cloud data stores” provides audit‑ready proof across multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Verisq’s Control Mapping capability lets you continuously collect evidence that storage services are encrypted, access‑restricted, and monitored, turning a reactive finding into a proactive assurance signal.
Who Is Affected — SaaS and technology providers, any organization that stores employee email credentials, and downstream customers whose mailboxes were compromised.
Recommended Actions
- Inventory all cloud data stores and verify that they are protected by least‑privilege IAM policies and encryption at rest.
- Deploy continuous configuration‑monitoring tools that generate immutable logs for audit purposes.
- Incorporate the “cloud data‑store configuration” control into your control‑mapping framework and collect evidence in the Verisq Trust Center.
Technical Notes
- Attack vector: misconfigured Elasticsearch instance exposed via the public internet.
- Data types exposed: email addresses and clear‑text passwords.
- No known CVE; the issue stems from inadequate configuration and lack of encryption.