RedDoorz's operator left a cloud key in an old app — 5.9M customers' data leaked

Commeasure, the Singapore firm that operates the RedDoorz hotel booking site, learned on 19 September 2020 from a US cyber-security firm that customer data had leaked. The personal data of nearly 5.9 million Southeast Asian customers, mostly from Indonesia and about 9,000 from Singapore, included names, contact numbers, emails, dates of birth, encrypted account passwords and booking information. The data was offered for sale on a hacker forum. Masked credit card numbers were not accessed.

Singapore's PDPC found that hackers likely reached the company's Amazon cloud database using an AWS access key embedded in an Android application package (APK) that Commeasure created in 2015. Embedding keys in code goes against AWS's advice, the key was wrongly labelled a 'test key', and the APK, though considered defunct, stayed downloadable on Google Play until the breach was found.

Because the APK was regarded as defunct, it was left out of the security review and tests Commeasure commissioned from September to December 2019, and out of a security tool that could have stopped the key being found. PDPC attributed this to negligence in keeping an inventory of IT assets in production, and said the reviews were not sufficiently rigorous. It fined Commeasure S$74,000 in a judgment issued on 11 November 2021.

Data of about 5.9M customers leaked; PDPC fined Commeasure S$74,000 in November 2021 for Singapore's largest data breach under the PDPA

An AWS access key was embedded directly in an app package, against AWS's own advice not to put keys in code.

The key was mislabelled a 'test key', which made it look harmless.

The APK was considered defunct, so it was not in the IT-asset inventory and was excluded from the 2019 security review.

PDPC found the periodic security reviews were futile for this exposure because the affected APK was never in their scope.

A forgotten asset is still an attack surface. If a 'defunct' app or key is not in the IT inventory, it is outside every security review, and attackers only need to find it once.

PDPC considered the hardship the pandemic had caused the hospitality sector and the company's remedial steps when setting the S$74,000 fine, well below the S$1M maximum then in force and the combined S$1M imposed on SingHealth and IHiS for the 2018 breach. After the incident Commeasure restricted live-database access to whitelisted IP addresses and added two-factor authentication for developer tools. All developers except one co-founder and the chief technology officer had left the company by the time of the ruling.