Public MongoDB Misconfiguration Exposes 166 K Victory Phones Customer Records
What Happened — In January 2017 Victory Phones left a MongoDB instance exposed to the Internet without any authentication. An unauthorised party downloaded the entire 213 GB database, extracting names, dates of birth, email addresses, phone numbers, physical addresses and IP addresses for 166,046 accounts.
Why It Matters for Trust & Control Assurance
- Unprotected data stores violate the “access control” and “configuration management” objectives that a continuous control‑assurance program monitors.
- The breach demonstrates the need for automated discovery and monitoring of cloud assets to provide defensible evidence that security baselines are enforced.
- Mapping this incident to a single control area (e.g., “Secure Configuration of Data Stores”) satisfies multiple framework requirements (NIST CSF 2.0, ISO 27001, etc.) in one audit artifact.
Who Is Affected — Telecommunications and automated‑telephony service providers; any organisation that stores customer PII in cloud‑hosted databases.
Recommended Actions
- Inventory all database services and enforce authentication and network‑level access controls.
- Deploy continuous monitoring tools that flag publicly reachable assets and generate audit‑ready logs.
- Conduct a post‑incident control review, map findings to the “Secure Configuration” control objective, and collect evidence for compliance reporting.
Technical Notes
- Attack vector: Misconfiguration – unauthenticated MongoDB exposed on the public Internet.
- No CVE; the flaw is operational.
- Data types exposed: PII (names, DOB, addresses, phone numbers, emails) and IP addresses.