In a startling revelation, CloudDefense.AI, a cybersecurity company, uncovered a critical data leak affecting Shell, the oil giant. The breach exposed the personal information of electric vehicle (EV) drivers, including the Greenlots CEO’s personal details. In this article, we know how CloudDefense.AI discovers critical security data breach for oil giant shell.
CloudDefense.AI’s Discover
During the investigation, CloudDefense.AI’s security researcher discovered an unprotected internal database linked to Shell Recharge. This extensive database contained nearly a terabyte of logging data related to Shell’s vast network of EV charging stations, which it obtained, in part, through the acquisition of Greenlots in 2019. Greenlots had been providing EV charging services and technology to customers with vehicle fleets.
The database, hosted on Amazon’s cloud infrastructure, comprised millions of logs containing sensitive customer information. Disturbingly, the lack of password protection meant that anyone with internet access could freely browse and access the data.
Implications for EV Drivers
TechCrunch, upon examining the leaked information, found that it included names, email addresses, and phone numbers of fleet customers utilizing Shell’s EV charging network. Furthermore, the database disclosed the names of fleet operators, which allowed for the identification of organizations, such as police departments, with vehicles reliant on the charging network. Some of the compromised data even included vehicle identification numbers (VINs).
Revelation of Charging Station Locations
In addition to customer data, the exposed database unveiled the locations of Shell’s EV charging stations, encompassing both public and private residential charging points. Notably, TechCrunch identified a record containing the residential address of Greenlots CEO Andreas Lips among the exposed information.
Response and Taken Action
The cause and duration of the database’s exposure remain unclear, although some of the compromised data was as recent as 2023. Upon discovering the breach, CloudDefense.AI’s security researcher Anurag Sen promptly notified Shell. However, when he did not receive a response, he alerted TechCrunch, who then contacted Shell on his behalf. Shortly after being contacted by TechCrunch, Shell took action to render the database inaccessible.
Shell spokesperson Anna Arata acknowledged the incident and stated that Shell had implemented measures to contain and identify the exposure of Shell Recharge Solutions data. The company is actively investigating the matter, continuously monitoring their IT systems, and will take necessary actions accordingly.
Conclusion
The CloudDefense.AI discovery of the data breach involving Shell and its EV charging network serves as a stark reminder of the ever-present threats in the digital world. It highlights the importance of robust cybersecurity measures, proactive monitoring, and swift responses to protect sensitive data and maintain trust in the evolving landscape of digital security.
Related Articles
