A Capgemini engineer's one-character edit leaked Razer data; court awarded $6.5M

Razer engaged IT consultancy WhiteSky Labs in 2019 to upgrade its digital commerce platform; Capgemini acquired WhiteSky in June 2020 and took over its obligations. Capgemini had recommended Razer use the ELK Stack (Elasticsearch, Logstash and Kibana). On 17 or 18 June 2020 a Capgemini employee was asked to troubleshoot because Razer staff could not log in to Kibana. Razer said he added a '#' command to a configuration file on the Elasticsearch server that controlled security and access, which allowed unauthenticated access to Kibana.

Security researcher Bob Diachenko alerted Razer to the exposure on 19 August 2020 and later estimated about 100,000 customers were affected; the breach, which exposed shipping and order details of thousands of customers worldwide, was widely reported in September 2020. Razer said card numbers and passwords were safe. The employee fixed the problem on 10 September by removing the '#'.

Capgemini denied causing the misconfiguration and argued that the log-in fix was outside its scope and that Razer maintained the stack. On the sixth day of trial in July 2022 the employee admitted he had caused it. In December 2022 Justice Lee Seiu Kin found the work was within the contracted scope, that Capgemini breached its obligations and was negligent, and awarded Razer US$6.5 million, mostly US$6.1 million in lost profits from Razer.com, plus about US$60,000 for forensics and US$320,000 for legal fees dealing with regulators.

A leak of shipping and order details of thousands of Razer customers; the court awarded Razer US$6.5M (S$8.7M), mostly US$6.1M lost profits.

A troubleshooting step on a log-in problem commented out the setting that enforced access control on the Kibana application.

The change was made by a vendor employee and apparently not caught by review, and the exposure went undetected for weeks.

Capgemini first denied responsibility and said the work was out of scope, until its employee admitted the change at trial.

The court found the log-in assistance was within the scope of work Capgemini had agreed to.

A quick fix to a log-in problem can turn off authentication; vendors need change review, and customers need a clear scope of who owns the security settings.

Razer won its lawsuit on 9 December 2022 and was awarded US$6.5 million in damages by Singapore's High Court. The court accepted that customer queries showed the incident reduced willingness to buy from Razer.com.