- Security researcher finds large unsecured database belonging to MyGiftCardSupply
- It contained images of vital documents, as well as selfie photos
- The company has since locked it down, but users should still be wary
A database containing sensitive information on hundreds of thousands of users was sitting unprotected online, available to anyone who knew where to look, experts have warned.
Cybersecurity researcher JayeLTee found a database containing driving licenses, passports, and other identity documents, which a subsequent investigation determined belonged to a company called MyGiftCardSupply, which sells digital gift cards that customers can redeem either online, or at popular stores.
The data was hosted on Azure and contained 600,000 front and back images of various identity documents. Furthermore, it contained roughly 200,000 selfies. Some companies require users to take a selfie holding a document, as proof of ownership and identity.
Full audit
Gift cards are often abused in online scams. People that steal money, especially cryptocurrency, will often purchase gift cards to avoid being tracked by law enforcement. To eliminate fraud and comply with local regulations, MyGiftCardSupply required all customers to go through a mandatory Know Your Customer (KYC) process, which requires them to verify their identities.
Unfortunately, the company kept that data unprotected, for an undisclosed amount of time. We don’t know if any threat actors discovered it beforehand, but it is a possibility. This type of data can be sold on the dark web, used in phishing and identity theft, and even abused in wire fraud.
JayeLTee said they reached out to MyGiftCardSupply to no avail, after which they contacted TechCrunch. In a response to the publication, the company’s founder, Sam Gastro, acknowledged the researcher’s findings, saying “The files are now secure, and we are doing a full audit of the KYC verification procedure.”
“Going forward, we are going to delete the files promptly after doing the identity verification.”
The company says it locked down the database on January 1, 2025.