Master Deeds Database Leak Exposes 2.26 M South African Personal Records
What Happened — A 27 GB backup file named “Master Deeds” containing personal data for 2,257,930 South African residents was found publicly accessible on a web server with directory‑listing enabled. The dump, dated 8 April 2015, included names, birth dates, government ID numbers, addresses, phone numbers, email addresses, employment details, ethnicities, genders, and deceased status.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate configuration management – a control‑area that continuous‑monitoring programs are built to detect and evidence.
- Highlights the need for documented data‑handling policies and proof that storage assets are protected by access‑control and encryption safeguards.
- Provides a concrete example of why organizations must maintain an auditable inventory of sensitive data and regularly validate that storage locations are locked down.
Who Is Affected – Residents of South Africa whose personal attributes were stored by the unnamed data‑provider (likely a data‑analytics or public‑records service).
Recommended Actions
- Conduct an immediate inventory of all data backups and archives; verify that storage locations enforce authentication and disable directory listing.
- Implement continuous configuration monitoring for web‑servers and cloud storage buckets, capturing evidence for audit trails.
- Update data‑protection policies to require encryption at rest and strict access‑control, then map those policies to your control framework of record.
Technical Notes – The exposure resulted from a misconfiguration (public directory listing) rather than a software vulnerability. No CVE is associated. The data types exposed are high‑value personally identifiable information (PII). Source: Have I Been Pwned – Master Deeds breach