Top API testing firm APIsec exposed customer data during security lapse

• Researchers found an unprotected database containing sensitive customer data
• It belongs to APIsec, a company specializing in API security testing
• Affected customers were allegedly notified

APIsec, a company specializing in proactive, automated, and continuous API security testing, may have inadvertently leaked sensitive customer data online, experts have said.

The discovery was first made by cybersecurity researchers UpGuard, and later confirmed by the company itself.

The data was being stored in an internet-connected database that wasn’t password-protected, and has apparently remained like that for “several” days before being locked down as soon as UpGuard notified APIsec.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)

View Deal

Notifying affected customers

Since the company tracks its clients’ APIs for security weaknesses, most of the data was generated by its own products.

Some of the data dated back to 2018, and included both customer employees and users’ names, email addresses, as well as API security posture information. Since this data included things like whether or not 2FA was activated, it is the type of information that can prove quite useful for a threat actor.

APIsec reportedly first tried to downplay the importance of the incident, saying the database held “test data”, that it wasn’t the company’s production database, and that it didn’t hold customer data, but changed its stance when presented with information suggesting otherwise.

Apparently, UpGuard found evidence that the database also held data from real-world corporate customers, including names and emails, and scan results.

When TechCrunch shared the information with APIsec, it later said that it notified customers whose personal information was found in the data. However, it didn’t want to say how many people were affected, nor did it want to share a copy of the breach notification letter.

Unprotected databases remain one of the key causes of sensitive data leaks. Many organizations use the cloud to host information about their employees, clients, or customers, forgetting the fact that cloud hosting works on a shared responsibility model.

You might also like

• Massive online data breach sees 2.7 billion records leaked - here's what we know
• We've rounded up the best password managers
• Take a look at our guide to the best authenticator app