Marketing Platform Straffic Exposes 48.6 M Personal Records via Unsecured Elasticsearch
What Happened
In February 2020 the Israeli marketing firm Straffic left a 140 GB Elasticsearch database publicly reachable on the internet. The index contained more than 300 M rows, including 48 580 249 unique email addresses together with names, phone numbers, physical addresses and gender information.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of unmanaged cloud‑native data stores; a continuous control‑assurance program would require inventory, classification, and regular access‑control validation of all Elasticsearch clusters.
- Highlights the need for defensible evidence that encryption‑at‑rest and authentication mechanisms are enforced before any personal data is stored.
- Shows how a lack of real‑time monitoring can prevent timely detection of exposed assets, undermining audit readiness for GDPR, CCPA, or other privacy regulations.
Who Is Affected
- Marketing and advertising SaaS providers that store consumer profiles.
- Any organization using Elasticsearch or similar search engines without proper network segmentation or authentication.
- End‑users whose personal identifiers (email, name, phone, address, gender) were stored in the breached dataset.
Recommended Actions
- Conduct an immediate inventory of all Elasticsearch (or similar) instances and verify that they are not publicly reachable.
- Enforce authentication, role‑based access controls, and TLS encryption for data in transit and at rest.
- Review data‑classification policies to ensure personal data is flagged for higher‑level controls.
- Update incident‑response playbooks to include rapid containment steps for misconfigured cloud services.
- Perform a privacy‑impact assessment and, where required, issue breach notifications in line with applicable regulations.
Technical Notes
- Attack vector: Misconfigured, unauthenticated Elasticsearch endpoint exposed to the internet.
- CVE(s): None reported; the issue stems from configuration rather than a software vulnerability.
- Data types exposed: Email addresses, names, phone numbers, physical addresses, gender.
Source: https://haveibeenpwned.com/api/v3/breach/Straffic