Data Breach Report: British Printing Press Leaks Confidential Material and More

March 19, 2020

The vpnMentor cybersecurity research team uncovered a leaking S3 Bucket with over 270k records and greater than 343GB in size on an Amazon server, belonging to Doxzoo. There are potentially over 100,000 users affected by this data leak, with implications not only for copyright violations, but also American and British military data exposure.

Doxzoo is a document printing and binding production company, based in the U.K., and services customers globally since 2014. The data leak includes print jobs for many high-profile clientele, including elite universities, U.S. and U.K. military branches, Fortune 500 companies and many more. On their website, Doxzoo boasts ISO accreditation for security.

Led by Noam Rotem and Ran Locar, the cybersecurity research team easily identified Doxzoo as the owner of the database and contacted the company with their findings. However, Doxzoo never responded to their communication attempts. They only closed the data leak after the researchers reached out to Amazon.

According to the researchers, Doxzoo has a handful of high-profile customers for whom they are executing a variety of print jobs, including complete scripts and screenplays, full-length books, sought-after paid wellness plans, and internal military handbooks, to name a few projects. They also get requests from private individuals who order family scrapbooks (complete with pictures of the kids), bachelorette souvenirs with potentially compromising photos of the bride-to-be, and more. Additionally, Doxzoo seems to regularly request full scans of photo IDs (such as passports) to fulfill orders.

Some of the data that was impacted includes:

PII
- Full names
- Addresses
- Email addresses
Passport scans
PCI
- Payment method
- Last four digits of payment method
Order details (items ordered, date, amount/receipt)
- Tracking labels
Copyrighted Publications
- Full-length books
- Screenplays
- Scripts for one of the top TV series around the world
Paid Programs
- University course material (including elite institutions)
- Diet and exercise plans
- Exam preparation classes
Teacher’s guides with answers for tests
Certifications, diplomas, and degrees
Medical documents, log books, etc.
Musical compositions
Religious texts
Floor plans detailing various security elements
Internal military documents (including classified information)

In addition, the leak impacts the U.S., U.K., Sri Lanka, Nigeria and India. The researchers note that items contained this leak often hold private and/or confidential information within. "The promise of secure facilities and systems are key selling points for clients such as the military, and the breach of that guarantee is not only a failure in service, but also potentially holds a security risk along with it," notes the report.

For more information, visit the vpnMentor report.

Protecting employees from potential exposure could be a daunting task, but with the right property technology, your office space can become an interactive and responsive asset that helps you ensure new health protocol compliance.

Join Resolver as we discuss practical strategies to help shift the security mindset in your organization. We’ll look at real examples of how industry-leading security teams have optimized their processes to provide more impactful reporting that not only enabled them to prove the value of corporate security to the organization, but also their increased departmental budget.