Personal Data of 1.3 Million Shoppers Exposed by Walmart Partner

Personal Data of 1.3 Million Shoppers Exposed by Walmart Partner

According to cybersecurity firm Kromtech, who found it stored in a publicly accessible Amazon S3 bucket.

The personal data of over 1.3 million people across the United States and Canada were publicly exposed online by Walmart's jewelry partner, according to cybersecurity firm Kromtech, who found it stored in a publicly accessible Amazon S3 bucket.

Researchers first assumed the Amazon web server belonged to Walmart, since the storage bucket was named, "walmartsql." However, they later uncovered the databased actually belonged to a Chicago-based firm called MBM Company Inc., which primarily operates under the name Limogés Jewelry.

According to Kromtech, the database was left exposed online since Jan. 13 2018, and included names, addresses, zip codes, phone numbers, email addresses, and plaintext passwords for 1,314,193 people.

It also contained numerous records for retailers other than Walmart. Over the years, Limogés Jewelry has done business with retailers such as Amazon, Overstock, Sears, Kmart and Target, among others.

Kromtech researchers also found internal MBM mailing lists, payment details, promo codes, item orders, as well as encrypted credit card details. The records exposed dated as far back as 2000 and extended to early 2018. Researchers believe this may have been MBM Company's main customer database.

“In more than one case, the sensitive data has been exposed by a partner or third party. Organizations need to not only take steps to secure sensitive data in their possession, but also as it’s handed off to these partners," Tim Erlin, VP, product management and strategy at cybersecurity firm Tripwire said. "Protecting customer data from this type of exposure doesn’t require amazing new security tools. Ensuring that systems are secure when deployed and monitoring them for changes is part of doing the basics right. Those security basics apply as much to the cloud as the data center.”  

Fortunately, shortly after the exposed data was found the publicly accessible database was "quietly" secured by Walmart. Kromtech found no evidence of ransom notes, but that doesn't mean no one accessed the data.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

  • Survey: 84 Percent of Healthcare Organizations Spotted Cyberattack in Last 12 Months

    Netwrix, a vendor specializing in cybersecurity solutions focused on data and identity threats, surveyed 1,309 IT and security professionals globally and recently released findings for the healthcare sector based on the data collected. It reveals that 84% of organizations in the healthcare sector spotted a cyberattack on their infrastructure within the last 12 months. Phishing was the most common type of incident experienced on premises, similar to other industries. Read Now

  • Keynote Speakers Announced for ISC West 2025

    ISC West, hosted in collaboration with premier sponsor the Security Industry Association (SIA), unveiled its 2025 Keynote Series. Featuring a powerhouse lineup of experts in cybersecurity, retail security, and leadership, each keynote will offer invaluable insights into the challenges and opportunities transforming the field of security. Read Now

    • Industry Events
    • ISC West
  • Study: Video Doorbells Have a 71% Service Attach Rate

    Parks Associates recently announced a new white paper, Consumer IoT Product Development: Managing Costs, Optimizing Revenues, which provides companies with a business-planning blueprint to evaluate how a consumer IoT solution will perform across its lifetime. Subscription services, such as video storage and professional monitoring, can be critical for covering ongoing cloud and support costs Read Now

  • Michigan City Fights Retail Crime With AI-Powered Video Surveillance, 911 Camera Sharing

    To combat persistent retail crime and deliver peace of mind to workers in the bustling North Leroy Street business district, the City of Fenton Police Department has deployed a new AI-powered video surveillance system with camera-sharing technology to accelerate response time during retail heists or other emergencies. Read Now

Featured Cybersecurity

Webinars

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3