The Hack uniquely discovered that a Colombian company has left two vulnerable environments exposing information from millions of citizens and client companies – this is possibly the largest cyber security incident in the history of the Latin American country.
The investigation was only possible thanks to an international collaboration between our team, French researcher Enzo (CEO of OnlineProtek, who notified the incident) and Colombian researcher Camilo Gutiérrez Amaya (of ESET).
The company in question is Mensajeros Urbanos, an express delivery platform that was founded in 2014 in the city of Bogota. The company operates on three distinct fronts: personnel, allowing any Internet user to request a search and delivery service; corporate, with a monthly contract to send sensitive documents; and commercial, with API integration to third party applications and e-commerce platforms or restaurants (thus facilitating the payment and ordering of the internet).
The investigation into this case has been ongoing since September, when Enzo, CEO of the French company OnlineProtek, uniquely notified the two vulnerable environments. A priori, it is believed to be a leak from Banco Davivienda, Colombia’s third largest bank; This is because one of the record data fields found in Elasticsearch mentioned “DaviPlata”, the mobile app of the financial institution in question.
Source: The Hack
