A security breach at the Covve Contacts app has leaked over 100 million records of 22 million users. This database was found online by Dehashed and shared with Troy Hunt for investigation back in February. The security expert has now come up with a blog post explaining what this incident is all about. Until itโs attributed to Covve, this incident is called db8151dd.
Initial Revelation
On May 15th, Troy Hunt, a security expert has revealed in his blog post that Dehashed approached him in February about a massive database publicly exposed to major cloud providers, accessible via Elasticsearch.
103,150,616 records belong to around 22 million users, totaling up to 90GB! At first, he and all others he worked with have failed to identify this gathering source but later found out from public disclosure of an app.
Finding Data About Self
It would be intriguing when youโre a security researcher and found your day in the case youโre investigating on. Troy Huntโs is the same story. Out of all the records he analyzed, he claimed to be found his records, including his phone number, email address, and others.
Further, his record was placed just beside anotherโs he had met in the past! While this was interesting, Troy guessed this could have been leaked from a CRM system, which would constantly be tracking their customersโ engagements. And not long after that, an official disclosure from Covve came out, clearing the air.
Public Disclosure
Covve is an AI-powered contact management app. This is a part of customer relationship management, where all the customer contacts and their interactions with the business are recorded to know them better. The public disclosure form Covve says they were informed about a data breach, where unauthorized access was made into one of their systems.
Upon discovery, they revealed that usersโ contact details had been accessed, but there were no sensitive details like passwords or card data. Further, theyโve decommissioned the impacted system to avoid further problems, informed the regulators, and continuing the investigation.