Mfcttrf

Just found my current company code on the plain internet.

We are talking hundreds of thousands of lines of scripts and configurations, including database schemas and a fair amount of internal information. Looks like an archive of some project(s), all concatenated into one file.

Didn't have time to go through everything yet. Quick search for exposed databases and credentials is hinting toward other files/functions that are missing.

This appear to be the personal website of a contractor who worked here 5 years ago.

Edit 1 hour later: Found sensitive information from every company that guy worked for in the last 2 decades, mostly F500: huge national bank, postal service, large electronics manufacturer, general electric...

Mix of code, configuration, notes and what appears to be console input logs. No idea why a guy would keylog himself let alone publish it on the internet, this is really odd.

It's a treasure trove. There are references to all kinds of internals with sometimes username and password. FTP access to production servers. SSH access to god knows what, even with the one-time RSA token number that was used if it was 2FA protected.

What can be done about that and who to contact? Cyber? Legal? FBI? SEC? Other? Any combination of these?

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally I would download it so you have a reference. You should take screenshots of your own data and avoid data that is not yours. Make sure you include the URLs. Document those in a way that a lawyer can understand. This is likely to become a legal problem not an IT problem. I say screenshots because that is unambiguous and lawyers understand screenshots.

Contact your internal lawyers, plus your communications or media people. You need to get this breach onto their radar. The lawyers will then need to look into the commercial contract with the contractor probably via the account management team if you work for a big old company. No one in senior leadership will want to find out about it from everyone's favourite IDS: Twitter. Your comms / PR teams will need to deal with any messages that come about from this. Your executive team may need to be involved. You should get guidance from your CIO unless you are the CIO in which case I would be inclined to inform people internally.

Engage with your company data protection officer. That may be the lawyer. They will decide if the breach is GDPR / ICO notifiable. You have to do this quickly as you have 72 hours to make the decision from the point you are aware, that includes the weekend. (never go looking for incidents on a Friday...) Your DPO will advise. If you are the DPO then you might want to engage your company external legal counsel to confirm your decisions.

Once you have looked at the data, you will be able to advice how many data subjects are affected if any. You will also be able to determine if the data breach affect any of your clients as you may have a contractual obligation to inform them.

Contact the hosting company. If it's something like github then they may be inclined to play nicely. You may need to get your lawyers to write to them as officers of the company.

Contact the contractor, ideally via their contracted company and via the in-house lawyer. Demand they take down what is there.

Now you can start to work out the material impact to your business. Credentials, keys and other authentication tokens will need to be changed I expect.

Depending on the size of your company and your appetite to risk and your pocket size you might want to consider bringing in a forensics-type company to go out hunting for similar data. Yes I know it's a bit of security theatre but if you work for a FTSE100 firm then a report with a Big4 audit badge saying "no more issues" is exactly what you need should the midden hit the windmill. (I am amazed at what I see big firms spend on such reports as, of course, the same thing from an internal person is often considered to count for little).

I am not sure about the data that is not yours. If you start trying to engage with third parties then you are bound to be asked what data you have got from them and they are bound to ask you to confirm that any data you have taken has been deleted. Personally I'd be inclined to ignore any data that is not mine. You might want to make a disclosure to whomever you think is the data owner, entirely up to you.

You mention keylog, if you are wondering why an individual might have a keystroke logger on their own PC then well to be generous they might be using it as a simple backup of what they type. I know people who have done that.

Aside: Finally as a tangential observation, what you have found is not that uncommon. People store all kinds of junk for example people link their home data storage to the internet via FTP: we run regular assessments for such data that contains our company strings.

You typically want to contact the hosting company to take it down and hold all data and logs under a legal hold.

You could also contact the other companies affected.

Legally, you will need to contact a lawyer and the law enforcement in your jurisdition.

It should go without saying, but make sure that those login credentials are not working on your system. If they weren't deactivated when he left your organization (when they should have been), you'll want to audit your access logs to make sure they haven't been used since he left -- if they were on a public website where anyone could find them, you should assume that someone has tried them.

Keep a careful log of everything you're finding, including details like when and how you're finding it. Law enforcement will want to know. You may very well have to testify in court about this one day -- even if your company doesn't sue, the other companies might, and you will look more professional if you have all the details ready when they call you as a witness.

For getting it taken down, you could have a US lawyer issue a DMCA takedown notice to the hosting provider, asserting that you own the content and have not consented to it being distributed - this should get an immediate reaction if the hosting provider honours DMCA notices, to which the contractor can respond.