MindBody-Owned FitMetrix Exposed Millions of User Records -- Thanks To Servers Without Passwords (techcrunch.com)

An anonymous reader writes: FitMetrix, a fitness technology and performance tracking company owned by gym booking giant Mindbody, has exposed millions of user records because it left several of its servers without a password. The company builds fitness tracking software for gyms and group classes -- like CrossFit and SoulCycle -- that displays heart rate and other fitness metric information for interactive workouts. FitMetrix was acquired by gym and wellness scheduling service Mindbody earlier this year for $15.3 million, according to a government filing. Last week, a security researcher found three FitMetrix unprotected servers leaking customer data. It isn't known how long the servers had been exposed, but the servers were indexed by Shodan, a search engine for open ports and databases, in September.

The servers included two of the same ElasticSearch instances and a storage server -- all hosted on Amazon Web Service -- yet none were protected by a password, allowing anyone who knew where to look to access the data on millions of users. Bob Diachenko, Hacken.io's director of cyber risk research, found the databases containing 113.5 million records -- though it's not known how many users were directly affected. Each record contained a user's name, gender, email address, phone numbers, profile photos, their primary workout location, emergency contacts and more. Many of the records were not fully complete.

Comments

Where do companies find....

[bev_tech_rob]

....these pinheads that set up these servers and don't even implement basic security?? Are these folks just non-IT personnel that just wing it while setting these systems up and don't have a clue or IT folks that don't give a rat's a**? I mean, REALLY???? NO PASSWORDS???????

Re:Where do companies find....

[Anonymous Coward]

....these pinheads that set up these servers and don't even implement basic security??

LinkedIN

Re:Where do companies find....

[quintus_horatius]

It's probably people getting a proof of concept going, and management saying "perfect, ship it as-is tonight!"

Re:Where do companies find....

[Archangel Michael]

People who have been in IT long enough, don't build a proof of concept without planning on that becoming live.

All of my test systems are built to go live, from the beginning.

Re:Where do companies find....

[Anonymous Coward]

A lot of managers believe that security has no ROI, and at worse, the consequences for a breach are minor. Even with the GDPR, a company just shrugs, says that the hackers are unstoppable, and life goes on.

As someone who has worked in Agile, if a developer has to choose between failing to make deliverables (which will get them fired immediately) versus some security issue that would get the company sued... they will take making their deliverables every time, because there are so many layers insulating them from their misdeeds. Even if a company gets hosed by the GDPR, the dev will suffer few, if any consequences.

Wish this would be different, but nobody really cares. Think someone would switch from "R" to "D" or vice versa over proposed security/privacy legislation? Nope. Another day, another massive breach.

Re:Where do companies find....

[HarrySquatter]

The H1-B outsourcing company that charges the least.

Re:Where do companies find....

[ripvlan]

They probably outsourced it --- and no where in the requirements did it say "please protect servers with a password"

RETARD EDITOR INCOMPETENCE

[Anonymous Coward]

Only an IDIOT protects a server with a password these days. Do msmash and Beau rub their margarita glasses in hallucinogenic bath salts?

I've taken to filling out false data anymore

[the_skywise]

Obviously for "real" stuff (credit cards, shipping addresses) I use real data. But for social activity or something like this I'll use a fake name and even a fake birthdate (but would keep the year accurate so, y'know, it doesn't tell me i'm capable of pushing my HR to 200 when it should only be 180).

Makes for interesting ads and assumptions for targetting (when the ads get through my browser)

Re:I've taken to filling out false data anymore

[ripvlan]

Yes. I now use the last 4 digits of my phone# for SSN these days. It works amazing well.

It's just a security question. And I also use a different month for DOB too (January 1, Feb 1, March 1 etc). Facebook is January (1), LinkedIn is Feb (2), Google is March (3), TicketMaster is (4) etc etc. This way when my data is stolen I know where the leak came from.

I have a scheme written down - just in case they ask me to prove myself.

From a management perspective, the real problem:

[remoteshell]

Is that the records weren't fully filled out. Fire the data entry clerks!

Servers Without Passwords

[Anonymous Coward]

That's a great name for an international organization involved in exchanges of culture, resources and best practices.

GDPR

[Anonymous Coward]

Sounds like someone hasn't heard of GDPR, and is about to find out about it the very hard and expensive way.

Re:goverment incompetence

[Anonymous Coward]

WTF are you even talking about? Was the US government involved with FitMetrix at all? .... NOPE you fucking trump supporting right wing ass twat.

Re:goverment incompetence

[Anonymous Coward]

What does the government have to do with this? The government didn't buy them. Another company did. You're an idiot and need to learn how to read.

Link to dump?

[Anonymous Coward]

Does anyone have a torrent/link to the dump? This data could be very interesting to us nerds.

Re:goverment incompetence

[HarrySquatter]

This isn't even good trolling...

AWS

[lashi]

Hosted by AWS? Doesn't AWE ask to set up password by default?

Re:AWS

[gweihir]

You can get "public" storage on AWS that you can hand out links to, no password required for read access. Of course, nobody with at least 1 brain cell uses this for confidential data.

Time to start to make them pay

[gweihir]

I think the CEO and CISO behind bars for 10 years and having their private fortune impounded to pay for the damage would be a good start. But since the law is not about actually protecting citizens, nothing will happen and that state will continue.

Re:Time to start to make them pay

[Anonymous Coward]

I'm sure you would love for the government to seize private cititzens assets when they have no liability. Until they come for yours.

And, DUH!

Servers Without Passwords

[Anonymous Coward]

I am the IT specialist of Servers Without Passwords, and after years of working with this non-profit NGO to liberate data in this increasingly locked-down online world, it's heartening to see headlines like these in recognition of our efforts.

Is this what Richard Stallman recommended?

[micahraleigh]

Didn't he want everyone to use the same password? Or no passwords?

Re:goverment incompetence

[Anonymous Coward]

Found the libtard apologist. Every time huge goverment failures come out guys like you, perhaps paid to do this, start defending it by accusing normal everyday americans like me of being a troll. sad.

Lawsuit

[Anonymous Coward]

Here's hoping they eat a big fat lawsuit

Re:goverment incompetence

[Anonymous Coward]

Read the article libtard. Government approved this companys operation. Of course it was done under Obama and Clinton so you criminal colluding democrat party types dont care.