Sega left a huge database of user information open to hackers

Sega logo
(Image credit: Shutterstock)

Sega Europe could have easily fallen victim to a data breach as security researchers recently discovered that the company had left sensitive files stored insecurely on a publicly accessible database.

Researchers at the security firm VPN Overview found the files in question stored on a misconfigured Amazon Web Services (AWS) S3 bucket. They were also able to obtain multiple sets of AWS keys that gave them read and write access to Sega Europe's cloud storage.

In addition to sensitive files, the misconfigured S3 bucket contained was also used to host websites for a number of popular Sega properties including Sonic the Hedgehog, Bayonetta, Football Manager and Total War as well as Sega's official site. In total, 26 public-facing domains controlled by Sega Europe were affected.

VPN Overview's researchers were able to upload files, execute scripts, alter existing web pages and modify the configuration of critically vulnerable Sega domains according to a new report.

Compromised email and cloud services

During its investigation, VPN Overview's security team recovered an API to the email marketing software MailChimp that gave it the ability to send emails from the address donotreply@footballmanager.com.

The team then sent multiple messages to test its access and every email it sent appeared legitimate and also used TLS encryption. From here, the researchers were able to alter existing MailChimp templates and even create their own. As all of the emails sent out to Football Manager users appeared legitimate and would be able to bypass email security checks, a malicious attacker could have used this access to launch phishing campaigns.

VPN Overview was also able to upload and replace files on three of Sega's content delivery networks (CDNs). As third-party websites often link to a company's CDN for an official version of an image or file, 531 additional domains were linked to Sega Europe's affected CDNs. As a result, an attacker could have abused the company's CDNs to distribute malware and ransomware to unsuspecting users.

After discovering Sega Europe's misconfigured S3 bucket, VPN Overview responsibly disclosed its findings to the company which then secured the database and all of its  affected cloud services and software.

We've also featured the best antivirus and best password manager

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home. 

Read more
A digital themed isometric showing a neon padlock in the foreground, and a technological diagram of a processor logic board in the background.
A top online gift card store may have exposed private data on hundreds of thousands of users
Data leak
Popular online bill paying site leaks data of thousands of users
healthcare
Over a million clinical records exposed in data breach
A man looking at a tablet with a brown Best Buy package on the desk in front of him
Huge Christmas data breach - 14 million shipping records leaked, putting shoppers at risk
Someone checking their credit card details online.
Millions of credit card details leaked online - watch out if you're paying for Christmas
Data leak
Top healthcare company exposes data on millions of patients - find out if you're affected
Latest in Security
China
Chinese hackers targeting Juniper Networks routers, so patch now
Google Chrome dark mode
Google updates Chrome extension rules to ban affiliate link injection without user action or benefit
Abstract image of robots working in an office environment including creating blueprint of robot arm, making a phone call, and typing on a keyboard
This worrying botnet targets unsecure TP-Link routers - thousands of devices already hacked
Avast cybersecurity
UK cybersecurity sector could be worth £13bn, research shows
An option to add Ambient Music buttons to the iOS 18.4 Control Center.
Apple fixes dangerous zero-day used in attacks against iPhones and iPads
Trump
Hackers are abusing $TRUMP tokens to lure victims in to new phishing scam
Latest in News
GTA 5
GTA Online publisher Take-Two is gunning for a black market that’s basically heaven for cheaters
The Discovery+ homepage
Discovery+ just got a big update to its streaming app that makes it more like Max – here are 5 great new features to try
Two Android phones on a green and blue background showing Google Messages
Struggling with slow Google Messages photo transfers? Google says new update will make 'noticeable difference'
China
Chinese hackers targeting Juniper Networks routers, so patch now
Google Meet create custom backgrounds
More AI features are coming to Google Workspace
Elayne, Egwene, and Nynaeve dressed regally and on horseback in The Wheel of Time season 3
'There's a reason why we do it': The Wheel of Time showrunner responds to fans who are still upset over the Prime Video show's plot alterations