Researchers discovered an unprotected customer database containing 11 million records, which include personal details. The data was found during a routine scan and was available via a MongoDB instance that was set up on the hosting infrastructure from Grupo-SMS USA and LLC. The data collection was 45.5GB in size and includes 10,999,535 Yahoo! email addresses along with first and last names, ZIP codes, state and city of residence, and physical addresses. Further investigation revealed that some of the records could be from users of SaverSpy website. SaverSpy was created on August 13th and provides printable and digital discount coupons for a variety of products. According to researchers, “it is part of an affiliate program that provides coupon offers from Coupons.com, a Quotient Technology website.” The company said that there was no evidence of a breach on their end. The database has been taken down, however it was accessed by attackers. Researchers have seen the database tagged as “Compromised” in Shodan with a ransom note demanding the owners to pay 0.4 Bitcoin to access the information.
