MongoDB Misconfiguration Exposes 7.4M Email Records at SEO Firm RankWatch
What Happened — In November 2016 RankWatch left a MongoDB database publicly reachable with no authentication. An attacker copied the us_emails collection, which contained 7,445,067 unique email addresses, names, employers, phone numbers and job titles, and posted the data to an online forum.
Why It Matters for Trust & Control Assurance
- Unauthenticated cloud data stores bypass the access‑control safeguards that a continuous control‑assurance program expects to monitor.
- The breach provides a concrete evidence gap that auditors will probe: lack of configuration‑change logging and missing proof of remediation.
- Demonstrating automated detection of misconfigurations and retaining remediation evidence satisfies a single control objective that maps to many frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected — SEO and digital‑marketing SaaS providers, and any organization that stores employee or client contact data in cloud‑hosted databases.
Recommended Actions —
- Inventory all cloud data stores and enforce strong authentication (e.g., IAM policies, network restrictions).
- Deploy automated misconfiguration scanning and retain logs as defensible audit evidence.
- Map the configuration‑control objective to your framework of record and test evidence collection regularly.
Source: Have I Been Pwned – RankWatch breach
Technical Notes — Attack vector: publicly exposed MongoDB instance (no CVE, pure configuration error). Data types: email addresses, names, employers, phone numbers, job titles. Source: same as above