Sensitive photos, videos of thousands of porn actresses leaked online
What's the story
In a major shocker, sensitive data of thousands of actresses associated with a porn cam affiliate network has been leaked on the internet. The information, which included the models' private photos, videos, and other critical data, was being exposed on an open server and could have been accessed by anyone who knew where to look. Here's what went down.
Discovery
Data left open on Amazon S3 bucket
Discovered by the researchers at vpnMentor, the data of the models was left open for access in an Amazon S3 storage bucket by porn cam affiliate network PussyCash. The repository had a whopping 20GB of data on 4,000 women, which included their personal information as well as more than 800,000 keys for photos, videos, and other file types.
Personal data
Personal information included ID photos, passport/ID numbers
The leak of photos/videos is scary, but what makes it even scarier is the amount of personal information accompanying it. Per vpnMentor, the dataset included the names of the actresses as well as their photo ID, passport/ID numbers, release forms, and driver's license images. Now, all this makes up a very lucrative package for stalkers to threaten the models or extort money from them.
Access
Thankfully, the access to the data has now been blocked
Even though the team that found the repository made multiple attempts to contact the folks at PussyCash and get the database remove, the network didn't respond back. However, ImLive, one of the brands associated with the network, took note of the matter and said they would address the issue. Eventually, the dataset was locked down on January 9, 2020.
Questions
Many questions still remain unanswered
The actresses' data is now safe, but it remains unclear if anyone, except the researchers, opened the repository before it was locked down. Also, the fact that the data was left open in the first place raises major questions over the security practices followed by PussyCash. Amazon S3 bucket could have been locked with simple authentication, but that didn't happen, seemingly due to negligence.