I.M.L. SLU Breach Advisory

Earlier this month, a popular adult cam site and its affiliate network were compromised due to an exposed AWS S3 bucket. This breach resulted in the loss of personal data for over 4,000 models that use their cam sites. There were around 875,000 files in total exposed in the breach, with extremely sensitive files and personal information being exposed.

Recommendations

Ensure your cloud providers buckets are not open to the world and you are aware of any permission changes to these buckets to prevent accidental data-leakage
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The exposed S3 bucket was identified by the vpnMentor security team in early January as potentially belonging to ImLive (the actual bucket owner was not identified by vpnMentor), and included an incredible amount of sensitive information related to their models, including:

Videos
Marketing materials
Photographs
Clips and screenshots of video chats
Zip files
Scanned documents

The files included in this bucket span back 15-20 years old, with the most recent files being a few weeks old. Along with the types of data listed above, the type of information gathered from these documents is massive, which includes: Full name, birth date, birthplace, citizenship status, nationality, passport ID, ID photo, personal signature, parent's full names, fingerprints.

In addition, there were pictures of some models' military identification card, which can have potentially career-ending consequences for military members engaging in this type of activity. Even outside of the military members, the data found in this breach can have devastating effects for all of the models, which could include extortion/blackmailing, used for targeted phishing attempts and/or scams, potential legal repercussions, stalking, and identity theft.