Fastway Couriers Data Breach .

byhookorbycrook · 25-03-2021 6:21pm #1

Dear ....

We are writing to inform you of a security incident which involved your personal data. We process your personal data for the purpose of delivering parcels to you.

What happened?

Regrettably, we have suffered a cyber-attack in which your personal data was compromised.

A vulnerability in our system commenced on the 23rd of February 2021. This vulnerability was contained by the 26th February 2021. However, we are aware that during the period in which the system was vulnerable your personal data was accessed by a third-party hacker.

The personal data consists of your name and address and may also contain your telephone number and email address. No other personal data has been compromised. We do not hold any financial or other sensitive personal data relating to you.

We have reported this incident to the Data Protection Commission and to An Garda Siochána.

How does this impact you?

The personal data which was compromised is limited to your name and contact details used to deliver your parcels. However, we are alerting you about this issue to advise you to exercise extra vigilance in relation to any unsolicited communications which may purport to be from Fastway.

We will never request any financial information from you.

We also remind you to avoid clicking on links or downloading attachments from suspicious emails.

We take our obligations to protect your personal data very seriously. Should you have any queries please contact dp@fastway.ie

Fastway Couriers

biko · 25-03-2021 6:25pm

https://www.infosecurity-magazine.com/news/fastway-couriers-confirms-security/

A globally franchised courier company has issued a notice confirming that it was the subject of a cyber-attack.

The assault on Fastway Couriers was discovered by one of the company's third-party IT development contractors on February 25.

In a security notice issued March 11, Fastway Couriers confirmed that a cyber-attack had occurred and that it had resulted in a data breach.

and https://www.fastway.ie/why-fastway/media-releases/399-statement-from-fastway-couriers-regarding-data-breach

This was released 11 March OP, did you just get mail now?

25-03-2021 6:26pm

Thread on it here
https://touch.boards.ie/thread/2058167775/1

Go to nearly the last post and there’s a link to a Reddit thread by the man who actually discovered that fastway data was open to anyone to see. It wasn’t a hack as they said. Interesting read.

25-03-2021 6:28pm

About data leaks from Fastway Couriers

Good day!My name is Alex Gor and I am a security researcher.On the 20th of February 2021, I discovered an open access database ElasticSearch / Kibana server [http://34.244.144.236:8080](http://34.244.144.236:8080/) (via the specialized search service [shodan.io](http://shodan.io/)), which, as I later found out, belonged to Fastway Couriers.The server was accessible from the Internet without entering a password, and anyone could enter freely.I downloaded some data for analysis and to identify the server ownership. After I identified the owner of the server (Fastway Couriers), I immediately contacted him using the contact information found inside the database. It was on February 24, 2021 (I am attaching a screenshot of the letter)

Only on March 2, an employee of Fastway Couriers Martin Doyle contacted me and thanked me for the vulnerability found.

The data was immediately deleted.

However, on March 11, the company issued a [press release](https://fastway.ie/why-fastway/media-releases/399-statement-from-fastway-couriers-regarding-data-breach) claiming that the company was the victim of a "malicious cyber attack." This is a lie.The company simply did not take proper measures to ensure data security and left the server with critical data in the public domain.

It should be noted that even now this server is exposed to 23 actual vulnerabilities and the company has not yet taken any measures to eliminate it. - [https://www.shodan.io/host/34.244.144.236](https://www.shodan.io/host/34.244.144.236)

I plan to publish a more detailed report on this incident in the coming days and can share with you if you are interested.

Contact me: [specialist.isec@protonmail.com](mailto:specialist.isec@protonmail.com)

UPD. **I would like to be contacted by journalists who spread the news about the "hacker attack"**

**If you are reading this post, please contact the above email for details. Thank!**

https://preview.redd.it/xvkxbf3ipsn61.png?width=1588&format=png&auto=webp&e1cda1f2

VinLieger · 25-03-2021 6:29pm

This is bollox, they didn't suffer a cyber attack they left a bunch of data unsecured and open to the internet.

https://www.reddit.com/r/DevelEire/comments/m7rtm4/about_data_leaks_from_fastway_couriers/

25-03-2021 6:32pm

How did Alex Gor discover the data? It didn't just pop up on his twitter feed

ohnonotgmail · 25-03-2021 7:12pm

Deleted User wrote: »

How did Alex Gor discover the data? It didn't just pop up on his twitter feed

using https://www.shodan.io/

BackOfMyBag · 25-03-2021 8:50pm

we used to deal with them when i lived in ireland for work deliveries forget the data breach , they had a fairly well deserved nickname of anyway but fastway . honestly one of the worst courier companys i have ever dealt with !

Infini · 26-03-2021 10:30am

BackOfMyBag wrote: »

we used to deal with them when i lived in ireland for work deliveries forget the data breach , they had a fairly well deserved nickname of anyway but fastway . honestly one of the worst courier companys i have ever dealt with !

Fartway courriers?

Infini · 26-03-2021 10:31am

BackOfMyBag wrote: »

we used to deal with them when i lived in ireland for work deliveries forget the data breach , they had a fairly well deserved nickname of anyway but fastway . honestly one of the worst courier companys i have ever dealt with !

Fartway courriers?