Defunct retailer of computer hardware and software NCIX has fallen to an alleged data breach.
The company’s database servers were sold at an auction without being wiped, Travis Doering of Privacy Fly claimed.
The Privacy Fly editorial also claimed that while looking through Craigslist for computer hardware, a title read “NCIX Database Servers – $1500 (Richmond BC)” led to a series of messages and eventually a visit to an agreed upon address.
In the warehouse, claimed to be located in Richmond, the seller, “Jeff,” handed Doering passwords on a piece of paper and the latter explored the database files, the editorial read. It also read that the seller then informed the writer of having the network drive.
“Jeff and I agreed to meet again on September 5th, 2018 after he had located all the hard drives for me to analyze,” the Privacy Fly article read.
After another series of emails and a crafted story about competing computer companies, Doering claimed to have found out that the owner of the hardware is NCIX’s previous landlord due to a failure to pay rent.
“Jeff stated that he was a former systems administrator for a Richmond based telecommunications company and was helping NCIX’s landlord recover the money he was owed in exchange for being able to copy the source code, and database to aid his development team on a project,” the editorial explained.
The editorial also revealed that Jeff had the “useful” unencrypted and cracked hard disks.
When September 5 rolled around, Doering wrote he visited the warehouse again.
“I first sat down at the desktop and discovered that it was used by a former NCIX employee named Chadwick Ma,” the Privacy Fly article read.
It also detailed that the desktop had confidential data in the form of invoices, customer IDs, as well as credentials. It was also claimed that the Supermicro servers contained sensitive data, notably data that went back 13 years.
“The nciwww file contained 291 tables from their NCIX US store and had multiple versions of the file with data going back to 2007,” the Privacy Fly article read. “The version I spent time analyzing was dated between November 2013 to February 2015.”
“There were also three hundred eighty-five thousand names, serial numbers with dates of purchase, addresses, company names, email addresses, phone numbers, IP addresses and unsalted MD5 hashed passwords. The database also contained full credit card payment details in plain text for two hundred and fifty-eight thousand users between various tables,” the editorial continued.
Doering wrote that after the data was discovered to have already been sold once, Jeff offered copied data for $15,000.
On his way out of the warehouse, the Doering reflected on the recklessness of not encrypting data, which leads to harm for other businesses and individuals.
