Public MongoDB Misconfiguration Exposes 763M Records at Verifications.io
What Happened — In February 2019, Verifications.io’s email‑validation service left a MongoDB database publicly accessible without authentication. The exposed instance contained 763,117,241 unique records, including names, email addresses, phone numbers, IP addresses, dates of birth, genders, employers, job titles, and physical addresses. No passwords were leaked.
Why It Matters for Trust & Control Assurance —
- Continuous configuration monitoring could have flagged the unauthenticated database before exposure.
- Demonstrates the need for auditable evidence that data stores are secured, a core control‑assurance objective.
- Aligns with the control area of secure configuration management, which satisfies multiple frameworks (e.g., NIST CSF, ISO 27001) through a single control objective.
Who Is Affected — SaaS email‑validation providers, their downstream customers, and the 763 million individuals whose personal data was stored.
Recommended Actions —
- Inventory all cloud‑hosted databases and enforce authentication, network segmentation, and least‑privilege access.
- Deploy continuous misconfiguration scanning and integrate findings into a control‑assurance dashboard.
- Update incident‑response playbooks to include rapid verification of data‑exposure incidents and evidence collection for audit purposes. Source: Have I Been Pwned – Verifications.io breach
Technical Notes — Attack vector: publicly exposed MongoDB instance (misconfiguration). No CVE associated. Exposed data types: names, email addresses, phone numbers, IP addresses, dates of birth, genders, employers, job titles, physical addresses. Source: same as above