Archive — US — techcrunch
API testing firm APIsec exposed customer data during security lapse
API testing firm APIsec exposed an internal database containing customer data for several days due to a security lapse, including personal information and security posture details of clients. The breach was discovered by UpGuard, leading to a rapid response from APIsec. Initially downplaying the incident, the company later acknowledged the presence of real customer data and informed affected users.
Key points
- APIsec's internal database was exposed to the internet without a password for several days.
- The database contained sensitive information dating back to 2018, including employee names and emails, as well as security information of APIsec's clients.
- UpGuard discovered the breach on March 5 and notified APIsec, which quickly secured the database.
- APIsec's founder initially claimed the data was 'test data' but later acknowledged that real customer information was exposed after presented with evidence by TechCrunch.
- The breach was attributed to a 'human mistake' and APIsec notified those affected.
- Private keys and missing credentials were found in the dataset, which were said to belong to a former employee.
Why it matters
- This incident reflects ongoing concerns about API security and the growing importance of securing customer data in the IT industry.
- With the increasing reliance on APIs as part of digital transformation, security lapses can have serious implications for businesses, particularly as regulatory frameworks for data breaches tighten.
- Past incidents in data breaches highlight the importance of responsible data handling and proactive security measures.
APIsec's recent exposure of customer data underscores the critical need for robust cybersecurity measures as reliance on API technology grows, emphasizing the importance of safeguarding sensitive information amidst increasing digital threats.