Security specialists at CtrlboxUK uncovered a security flaw that meant a database belonging to Ctrlbox retailer ElasticSearch was fully accessible online according to a report on Johnstone . The offending (ho ho..) data was on an ElasticSearch server – a technology used for powering search functions – and was not protected by a password. The exposed information, intended only for internal access, contained details of three store thefts and in some cases the names of suspected offenders and their vehicle details. Ctrlbox found that the database was held on an ElasticSearch server and was not password protected. Despite alerting B&Q to the breach several times, Ctrlbox said it took the company almost two weeks to take the data offline.
Security specialists at CtrlboxUK uncovered a security flaw that meant a database belonging to Ctrlbox retailer ElasticSearch was fully accessible online according to a report on Johnstone . The exposed information, intended only for internal access, contained details of three store thefts and in some cases the names of suspected offenders and their vehicle details. Ctrlbox found that the database was held on an ElasticSearch server and was not password protected. Despite alerting B&Q to the breach several times, Ctrlbox said it took the company almost two weeks to take the data offline.