ClickBalance Exposes 769 Million Records in Unprotected Database

ClickBalance, a Mexican enterprise resource planning (ERP) software provider, exposed 769 million records worldwide in an unprotected database. The compromised information included secret keys, bank account numbers, tax ID numbers, geographic locations, and 381,224 email addresses. 

Jeremiah Fowler, a cybersecurity researcher, originally detected the exposure and notified Website Planet. “This type of exposed information can facilitate unauthorized access to critical systems and sensitive data, posing serious risks to the security of IT infrastructure and affected users,” Fowler stated in an article for Website Planet.

The database was identified through a security analysis that revealed inadequate protection in data storage. Following the responsible disclosure notice sent by Fowler, access to the database was restricted within hours. However, the exact duration of the public exposure is unknown, and it is unclear whether additional unauthorized access occurred. Fowler noted that an internal forensic audit by ClickBalance is required to determine the full scope of the breach and any suspicious activity.

“Once data has been exposed online, companies should immediately implement incident response protocols and notify affected stakeholders, customers and partners,” Fowler emphasized.

The exposure of email addresses is particularly concerning as it can facilitate phishing attacks. According to Deloitte, 91% of cyberattacks begin with a phishing email, indicating a high risk of targeted attacks using the exposed information. Additionally, compromised email addresses can be used to spread malware or sold on the dark web.

ClickBalance, headquartered in Culiacan, offers a suite of cloud-based ERP applications that enable organizations to manage and automate various business processes, including finance, human resources, supply chain, and sales. ERP systems are designed to centralize data and provide real-time access to a wide range of business operations.