Freely subscribe to our NEWSLETTER

The database included hundreds of thousands of contract details for volunteers in the program, plus more than 1 million names, email addresses, and passwords of users who signed up through the website.

Comparitech’s security research team, led by cybersecurity expert Bob Diachenko, discovered the database on May 30 and reported it to the French Civic Service the same day. The organization acted quickly and secured the exposed server a few hours later.

The French Civic service told Comparitech in a statement that a subcontractor had exposed the database of former volunteers:

The “Agence du Service Civique” was alerted on Saturday 30 May at 3.30 pm that a security breach was detected in the system of one [of] our subcontractors and had allowed access to a personal database of former volunteers with the French Civic Service. Immediately, the “Agence du Service Civique” did everything that what necessary to find the origin of the breach and secure it. Access was blocked on Saturday 30 May at 7pm.

It was a test platform, not our website, on which one of our subcontractors had loaded our database without a proper secure system on May 25th. Our investigation on the history of unauthorized access on this database shows that, to the best of our knowledge, no malicious intrusion occurred on the platform.The incident report has been sent to French authority CNIL “Commission nationale de l’informatique et des libertés” and the Ministry in charge was permanently informed during our investigation. A full audit of all our systems will be launched. We are committed to keep our awareness raised about cyber hygiene.

Timeline of the exposure

The database was exposed for five days in total:

May 25, 2020: A subcontractor working on behalf of the French Civic Service deployed the database

May 27, 2020: The exposed database was indexed by search engine Shodan.io

May 30, 2020: Diachenko discovered the database and reached out to French security researcher Baptiste Robert, who helped bring the incident to the attention of the French Civic Service

May 30, 2020: The exposed data was secured about three hours after Diachenko’s disclosure

Although the French Civic Service stated that no malicious intrusions occurred, we cannot confirm whether any other unauthorized parties accessed the data.
What data was exposed?

The open and unprotected MongoDB database contained several sets of data, including:

373,892 volunteer details, including ELISA contract information. ELISA (Local Extranet for Compensation and Monitoring of Volunteer Reception in Civic Service) is the system used to authorize organizations that wish to hire volunteers through the French Civic Service and manage contracts and payment between those organizations and their volunteers. Information in these documents includes:
Full names of both parties
SIRET identification numbers
Terms of volunteer service
Internal documents and links

More than 1 million website user records including:
Email addresses
Full names
Account passwords

A directory of 1,913 high profile contacts including:
Street addresses
Phone numbers
Email addresses

Dangers of exposed data

Although the French Civic Service says no malicious intrusions were detected, we strongly recommend impacted users and volunteer organizations take steps to protect themselves in case cybercriminals managed to steal the exposed data.

The leaked passwords are the most worrying. Affected users should immediately change their website login passwords. Additionally, if the same password and email combination were used on any other account or service, change those as well to prevent credential stuffing attacks.

Anyone whose contact information was exposed should be on the lookout for scam and phishing emails from criminals posing as the French Civic Service and related organizations.

Why we reported this exposure

Comparitech works with security researcher Bob Diachenko to find and report instances of personal data exposure online. On finding, for instance, an unsecured database full of sensitive information, we immediately begin trying to find out who the data belongs to, who may be affected, what type of information was exposed, and any potential ramifications that could occur as a result of this data being in the public domain.

Our goal is not to name and shame organizations for their security failings. Rather, it is to prevent people from becoming victims of identify theft, spear-phishing campaigns, and other malicious attacks as a result of having their data exposed. This is why, before making our findings public, we first coordinate with the database owners and ensure that the data is no longer accessible.
Previous reports

This is far from the only instance of its kind. In the past, our team has discovered several similar incidents, including when:

42 million Iranian “Telegram” phone numbers and user IDs were breached
Details of nearly 8 million UK online purchases leaked
250 million Microsoft customer support records were exposed online
More than 260 million Facebook credentials were posted to a hacker forum
Almost 3 billion email address leaked, many with corresponding passwords
Detailed information on 188 million people was held in an unsecured database
K12.com exposed 7 million student records
MedicareSupplement.com made 5 million personal records publicly available
Over 2.5 million CenturyLink customer records were leaked
Choice Hotels leaks records of 700,000 customers