A Brazilian Wi-Fi management software firm was at the center of an incident that exposed data of various high profile companies and millions of their customers.

Recommends

How the top VPNs compare: Plus, should you try a free VPN?

We tested the best VPN services -- focusing on the number of servers, ability to unlock streaming services, and more -- to determine a No. 1 overall. Plus, we tell you whether free VPNs are worth trying.

Read now

The company in question is WSpot, which provides software that enables businesses to secure their on-premise Wi-Fi networks and allow password-free online access to their customers. The exposure was discovered by security research firm SafetyDetectives.

The researchers found WSpot's misconfigured Amazon Web Services (AWS) S3 bucket, which was left open and exposed 10GB worth of data to the public. After discovering the sensitive data on September 2, the researchers contacted the software firm on September 7. WSpot secured the breach the following day.

Some 226,000 files were exposed in the incident, the researchers noted, including personal information from approximately 2.5 million individuals who connected to the public Wi-Fi networks provided by WSpot clients. The company's client portfolio includes Pizza Hut, financial services provider Sicredi, and healthcare firm Unimed.

According to SafetyDetectives, the set of information exposed included details supplied by individuals in order to access the Wi-Fi service provided by the companies. This includes full name, email address, full address, and taxpayer registration numbers -- in addition to the login credentials created in the registration process.

WSpot confirmed the incident toZDNet, saying the issue was caused by a "lack of standardization in the management of information [stored] in a specific folder." The Brazilian company reiterated that it has been working to address the issue since it was contacted about it until the conclusion of technical procedures on November 18.

WSpot states that its servers remain intact and were not invaded by malicious actors, saying there's no evidence that the exposed data has been accessed by cybercriminals. However, the software firm also stated that it has hired a security company to fully investigate any repercussions in relation to the data leaked in the incident.

WSpot says the issue impacted 5% of its total customer base, and none of its clients had business and/or sensitive information compromised. Additionally, it reiterated that it does not capture financial information such as credit card details or access credentials to other services. 

It's unclear whether the company will inform the individuals exposed about the incident.

According to a WSpot spokesperson, the National Data Protection Authority has not yet been contacted about the incident, however, "all legal issues surrounding the case are being addressed by WSpot as thoroughly as possible, especially in order to ascertain the next steps."

Security

8 habits of highly secure remote workersHow to find and remove spyware from your phoneThe best VPN services: How do the top 5 compare?How to find out if you are involved in a data breach -- and what to do next

• 8 habits of highly secure remote workers
• How to find and remove spyware from your phone
• The best VPN services: How do the top 5 compare?
• How to find out if you are involved in a data breach -- and what to do next