Ukranian cybersecurity firm Kromtech discovered an unsecured cache of files related to the commercial operations of the Australian Broadcasting Corporation, stored with Amazon Web Services’ S3 ‘buckets.’ The contents allegedly included several thousand emails, customer logins and passwords, requests for licensed content, and 1,800 daily database backups made since 2015.  

ABC forgot its ABCs 

The breach was found to have been a result of human error, not dissimilar to that which caused an outage in AWS’ US-East-1 region earlier this year, when Amazon’s S3 storage buckets - logical units of storage on its storage service - were misconfigured, so as to be publicly visible.

In a blog post, Kromtech reported that the bucket was indexed by search engine Censys, and was only found when the security company conducted a routine check.

The incident is the second serious data breach to hit Australia’s national broadcaster in recent years. In 2013, an associated forum website commissioned by ABC, Making Australia Happy, was hacked, potentially exposing up to 50,000 email addresses and usernames. 

No breaches affecting the broadcaster were quite as significant as that which affected Yahoo in 2014. When the incident - which was reported to have been perpetrated by a state-sponsored actor - occurred, the company announced that 500 million of its users’ data may have been compromised, then doubled the estimate to 1bn, and last month, stated that all 3bn of its subscribers may have had their personal data stolen.