Smile On Fridays secured coverage in TEISS for OneLogin!

Driving licences of 54k Australians leaked via misconfigured S3 bucket

A misconfigured Amazon Web Services S3 bucket was recently found containing photos of driving licences of around 54,000 Australian citizens. The photos contained detailed personal information such as names, dates of birth, driving licence numbers, and home addresses.

The misconfigured S3 bucket was discovered by security researcher Bob Diachenko who said via a Twitter post that the bucket contained front and back images of more than 50,000 driving licences.

ABC News quoted Diachenko to state that the AWS S3 bucket was easily discoverable, contained as many as 108,535 back-and-front scans of driving licences of drivers who registered in New South Wales and was probably viewed and abused by malicious actors.

While Diachenko said the S3 bucket was most likely a part of the New South Wales RMS infrastructure, Transport for NSW said the collection of files did not belong to the department as it did not “retain, nor collect tolling data in the manner described.”

“Transport for NSW is, however, working with Cyber Security NSW to investigate the alleged data issue relating to an Amazon Web Services S3 bucket containing personal information including driver licences,” a department spokesperson said.