Sensitive FedEx customer data left in public cloud storage

Sensitive FedEx customer data was discovered in publicly available online storage by security researchers for IT company Kromtech—data that may have been stored there since 2009.

According to the Kromtech Security Center report, researchers found 119,000 scanned documents in an easily accessible Amazon S3 bucket, which is a unit of storage Amazon sells as part of its cloud storage services.

The documents included photo ID scans and completed US Postal Service forms from customers around the world. They had been collected by Bongo International, an e-commerce solutions company, which was acquired by FedEx in 2014 and renamed FedEx Cross-Border International.

Kromtech reached out to FedEx but the company did not respond until it was contacted by ZDNet reporter Zack Whittaker. The bucket has since been removed.

“After a preliminary investigation, we can confirm that some archived Bongo International account information located on a server hosted by a third-party, public cloud provider is secure,” FedEx stated.

“The data was part of a service that was discontinued after our acquisition of Bongo. We have found no indication that any information has been misappropriated and will continue our investigation.”

(Source: Ars Technica)