Popular Office App Could Expose Thousands of Employees’ Data

The data breach reportedly affected around 900 companies, including major enterprises such as Dell, Capital One and Verizon, which posted their employee data online.

A third-party app, Simpli (formerly Charm City Concierge), was found to be hosting a publicly accessible online directory, which revealed that the credentials of up to 10,000 employees from infected companies were exposed.

This information was found by researchers from Cybernetics in an open web directory that stored backups of the company’s application database and website, made in January 2024. Many employees registered with the external service using their company email addresses, which could expose companies to malicious actors targeting work-related endpoints.

Supply Chain Attacks

A wealth of details and potentially sensitive operational information was exposed via app commands and notes, leaving organizations vulnerable to data theft and even worse.

Researchers also found email addresses, encrypted passwords and meeting details, including the purpose of the meetings and participants.

The incident is another reminder of the growing risk of supply chain attacks on businesses. While businesses have become more concerned about cybersecurity in recent years, weaker elements in the supply network have become targets for threat actors looking to attack otherwise secure corporate data.

Suppliers and third parties often possess sensitive company and customer information, making them an effective means for threat actors. Latest Research taken over Third-party attack vectors account for almost 30% of data breaches in recent years. With about 98% of organizations with a third-party connection experiencing a data breach, it has become a major security concern.

Researchers advise security leaders to ensure that robust third-party risk management plans are in place to prevent and recover from security breaches.