French transportation company Régie Autonome des Transports Parisiens (RATP) has left around 60,000 workers susceptible to fraud and other malicious acts after leaking their personal information via an unsecured server. This vulnerable server was discovered by security research firm vpnMentor and reported to the company almost immediately. Although RATP never responded, the French computer security incident response team took over and were able to secure the issue. While investigating the incident, they concluded that information on the server dated back to 2018 and included many high-ranking employees, even some belonging to the cybersecurity team. Data that could be found on the server included full names, email addresses, logins for RATP employee accounts, and MD5-hashed passwords. Additionally, another folder that was accessible could have allowed access to source code. This data also included API keys that could have given total access to RATP’s GitHub account.
Analyst Notes
Those whose information may have been included should change their passwords as soon as possible. It would also be useful to be on the lookout of any suspicious emails coming from unknown senders. If any fraud or suspicious activity is noticed, it should be reported to the proper authorities immediately.
Source: infosecurity-magazine.com/news/french-transport-giant-exposes/?&web_view=true
