A researcher discovered a misconfigured MongoDB server that belongs to the Abbyy software company hosted on AWS (Amazon Web Services) with no login required. The database was 142GB and contained over 200,000 files of scanned data from Abbyy customers and kept ready in the cloud. Included were non-disclosure agreements, memos, sensitive scanned documents, and internal letters. “Some collection names like ‘documentRecognition,’ or ‘documentXML’ hinted that database would be part of a data recognition company infrastructure,” the researcher said. The evidence that the database belonged to Abbyy came from another collection of documents which included usernames in the form of corporate emails, along with encrypted passwords. Two days after the information was reported to Abbyy, access to the database was disabled. It is unclear for how long the information was exposed.
