2020 — Estée Lauder: Security researcher Jeremiah Fowler discovered an…
Data compromised
Emails, internal docs, network info, CMS logs
Technical writeup
Jan 2020. Security researcher Jeremiah Fowler discovered an unprotected cloud database with 440M+ records. Exposed data included plaintext email addresses (customer and internal), internal documents, marketing reports, IP addresses, ports, network pathways, CMS logs, and middleware info. No payment card data. Estée Lauder claimed it was a limited non-consumer education platform; database was secured after notification.
Root cause
Unprotected cloud database; no password protection.