Groupon India, Sosasta, Accidentally Publishes User Database

Last week I wrote about how Air India’s Centaur Hotel accidentally published customer information to its website. At the time, I remarked that the hotel didn’t look like it had invested much into its homepage. They are after all a hotel company first. But today I was pretty stunned to find that Sosasta.com, a subsidiary of internet coupon giant Groupon acquired early in the year, has made a similar blunder this past weekend.

Sosasta inadvertently left SQL database files publicly accessible on the web. The data included email addresses and password info for the service’s 300,000 users, but apparently no credit card information. Groupon has issued a (relatively quiet) statement on the incident, though we aren’t aware of any disclosure published on the Sosasta or Groupon websites:

After being alerted to this issue by an information security expert, we corrected the problem immediately. We have begun notifying our subscribers and advising them to change their SoSasta passwords as soon as possible. We will keep our Indian subscribers fully informed as we learn more. SoSasta runs on its own platform and servers, and is not connected to Groupon sites in other countries. We are thoroughly reviewing our security procedures for SoSasta and are implementing measures designed to prevent this kind of issue from recurring. This issue does not affect data from any other country or region.

Sosasta is also taking inquiries via its customer support line if any customers still have concerns.

The database was discovered by Australian security consultant Daniel Grzelak (@dagrz) who got in touch with the website Risky.Biz, who in turn informed Groupon. Both Sosasta and its parent company can consider themselves lucky that it wasn’t a more mischievous hacker that discovered the file. But then again, who’s to say that this didn’t already happen before Daniel found it?

[Source: ZDnet, photo campaignindia.in]