Public PostgreSQL Database Leak Exposes 50,538 VC Firm Accounts
What Happened — In September 2021 a publicly accessible PostgreSQL database owned by Playbook, the venture‑capital platform of Plug and Play Ventures, was discovered. The database had been exposed on the internet since October 2020 and contained more than 50 k unique email addresses, names, phone numbers, job titles and passwords stored as PBKDF2 hashes. It took over two weeks after the breach was reported for the firm to secure the instance.
Why It Matters for Trust & Control Assurance
- Continuous asset‑inventory and configuration monitoring would have flagged the exposed database before attackers could harvest data.
- Documented remediation timelines provide defensible evidence for auditors and regulators that due‑diligence controls are being exercised.
- Mapping this exposure to a control‑assurance program demonstrates that the organization can prove “secure configuration” and “incident response” controls are operating effectively.
Who Is Affected – Venture‑capital firms, portfolio companies, and any individuals whose credentials were stored in the Playbook service (financial services sector).
Recommended Actions –
- Conduct an immediate inventory of all cloud‑hosted databases and enforce “private‑by‑default” network controls.
- Deploy continuous configuration‑monitoring tools that generate audit‑ready evidence of compliance with secure‑configuration controls.
- Rotate all compromised passwords, enforce multi‑factor authentication, and notify affected individuals per applicable privacy regulations.
Technical Notes – The exposure resulted from a misconfiguration that left the PostgreSQL instance reachable without authentication. Data types leaked included email addresses, full names, phone numbers, job titles and password hashes (PBKDF2). No known exploitation of additional vulnerabilities was reported.