vpnMentor's research team, led by Noam Rotem and Ran Locar, discovered a data breach belonging to the Spanish e-learning platform 8Belts, affecting 150,000s of people across the globe. 

8Belts, created in Spain, was partly financed by the European Union's European Regional Development Fund (ERDF) and Spain's Ministry for Energy, Tourism, and Digital Agenda, meaning the company falls within the jurisdiction of the EU's GDPR. 

According to vpnMentor's report, the breach originated from a misconfigured Amazon Web Services S3 bucket, exposing the private data of 8Belts users, and making them vulnerable to dangerous cyberattacks. 

The breached S3 bucket contained different types of data relating to 8Belts users and the platform's internal processes, say the researchers. Stored in CSV format, users records contained personally identifiable information (PII) data for individual 8Belts users, including:

  • Full names
  • Email addresses
  • Phone numbers
  • Dates of birth
  • Country of residence

Other files in the S3 bucket exposed even more PII of 8Belts users, including students and potentially teachers, such as:

  • National ID numbers
  • Skype IDs

Aside from PII data, details of students’ account details, course history and performance were also exposed, including the courses they’d taken, account user IDs, their evaluation scores, and certificates of completion. Virtual 8Belts gift cards to be shared with friends were also accessible via the exposed S3 bucket.

The exposed S3 bucket also contained site logs detailing how 8Belts integrates with external CRM systems. Along with exposing user PII data, these logs also revealed considerable technical information that could be exploited by hackers to gain further access to 8Belts’ platform.

Aside from private users, 8Belts is also a popular e-learning platform for large corporations helping their employees learn new languages. On its website, 8Belts boasts some of the biggest and most well known multinational companies as clients, says the report, including:

  • Bridgestone
  • Decathlon
  • Deloitte
  • Huawei
  • Inditex
  • PricewaterhouseCoopers
  • Real Madrid
  • Renault
  • Santander

Just like with individual users, 8Belts stored the PII data of users from their corporate clients within the exposed S3 bucket. However, in this case, many people used their company work email addresses to sign up.

The exposed employee PII data could have created a significant security risk for the companies, as hackers could use employee emails to attack a company’s entire corporate network infrastructure, warn the researchers. 

For the full report, including examples of PII, please visit https://www.vpnmentor.com/blog/report-8belts-leak/