58.8 M Personal Records Exposed from Modern Business Solutions Database‑Hosting Service
What Happened — In October 2016 a MongoDB dump containing 58,843,488 unique records was posted publicly on Twitter and later removed. The file held email addresses, IPs, names, dates of birth, phone numbers, physical addresses, genders, and job titles. The data has been linked to Modern Business Solutions (MBS), a provider of data‑storage and database‑hosting services, which has not publicly acknowledged the incident.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient security controls in third‑party data‑hosting environments – a scenario continuous vendor‑risk programs are built to detect and evidence.
- Highlights the need for auditable proof that providers enforce strong access restrictions, encryption at rest, and regular monitoring of data stores.
- Provides a concrete incident that can be used to validate the effectiveness of your own incident‑response and breach‑notification processes.
Who Is Affected – Organizations that stored customer or employee data with MBS, spanning technology/SaaS, financial services, healthcare, retail, and any other sector that outsourced database hosting.
Recommended Actions
- Map this breach to the “vendor risk management” control area and collect evidence of your providers’ security policies, encryption practices, and monitoring logs.
- Initiate a review of all third‑party database services you use; verify that they enforce least‑privilege access, network segmentation, and regular vulnerability scanning.
- Update your incident‑response playbook to include rapid notification and credential‑reset procedures for any exposed personal data.
Technical Notes – The exact attack vector was not disclosed; the public dump suggests either a misconfiguration that left the MongoDB instance exposed or unauthorized credential use. No specific CVE is associated with the incident. Source: Have I Been Pwned – Modern Business Solutions breach