Security specialists at CtrlboxUK identified a security flaw that meant a database belonging to UK retailer B&Q was fully accessible online according to a report on Graham Cluley . Four days after the first notification, Johnstone says that the data was still wide open: “…clearly they had not got the message and it was becoming clear that B&Q was not going to act on this any time soon, so another message was sent to support who once again assured me that the message had been sent to the right people.” The exposed database , intended only for internal access , contained details of various store thefts and in some cases the names of suspected offenders and their vehicle registration . Ctrlbox said that the data was held on an ElasticSearch server and was not password protected . Despite alerting B&Q to the breach several times , Ctrlbox said it took the company nearly two weeks to take the data offline .
Security specialists at CtrlboxUK identified a security flaw that meant a database belonging to UK retailer B&Q was fully accessible online according to a report on Graham Cluley . The exposed database , intended only for internal access , contained details of various store thefts and in some cases the names of suspected offenders and their vehicle registration . Ctrlbox said that the data was held on an ElasticSearch server and was not password protected . Despite alerting B&Q to the breach several times , Ctrlbox said it took the company nearly two weeks to take the data offline .