More than a million fingerprints and other sensitive data have been exposed online by a biometric security firm.
Researchers working with cyber-security firm VPNMentor managed to access data from a security tool called Biostar 2.
It is used by thousands of companies worldwide, including the UK’s Metropolitan Police, to control access to specific parts of secure facilities.
Suprema, the company that offers Biostar 2, said it had taken steps to address the issue.
“If there has been any definite threat on our products and/or services, we will take immediate actions and make appropriate announcements to protect our customers’ valuable businesses and assets,” a company spokesman told the Guardian.
According to VPNMentor, the exposed data, discovered on 5 August, was made private on 13 August.
It is not clear how long it was accessible.
As well as fingerprint records, the researchers say they found photographs of people, facial recognition data, names, addresses, passwords, employment history and records of when they had accessed secure areas.
Among the UK companies directly affected by the breach was Tile Mountain, a homeware retailer.
The BBC has contacted the firm for comment.
Suprema ‘hung up’
“It’s crazy, just crazy,” Noam Rotem, one of the researchers who found the data, told the BBC.
He pointed out that biometric information such as fingerprints could never be made private again once lost.
He said he and his colleagues had had difficulty when trying to report the exposed data to Suprema.
“We started calling all of the offices one by one and had to deal with people just hanging up the phone,” he said.
In total, 23 gigabytes of data containing nearly 30 million records were found exposed online.
“This could be used in a wide range of criminal activities that would be disastrous for both the businesses and organisations affected, as well as their employees or clients,” said VPNMentor in a blog about the discovery.
The data leak was “horrendous”, according to Simon Birchall, managing director for Timeware, a British firm that installs Suprema fingerprint readers.
Mr Birchall said Timeware had developed its own software for the devices and did not provide Biostar 2 to clients.
“It looks like someone has taken the standard Biostar 2 product and installed it on an open network,” he told the BBC. “It’s just silly what they’ve done.”
Police checking
Mr Rotem told the BBC that a number of British companies had been affected.
However, he was not able to confirm their names because he and his team did not download all the data they found in order to limit the privacy implications of the breach.
A spokesman for the Metropolitan Police told the BBC it was checking whether the force was one of the affected organisations.
Among other firms whose data was discovered were:
- Power World Gyms, a gym franchise in India and Sri Lanka – 113,796 user records including fingerprints
- Global Village, an annual festival in the United Arab Emirates -15,000 fingerprints
- Adecco Staffing, a Belgian human resources firm – 2,000 fingerprints
Suprema has not yet responded to a BBC request for comment.
The UK Information Commissioner’s Office said it was aware of reports about Biostar 2 and would be making enquiries.
Source: BBC
