How many courts have had sealed and sensitive files exposed by one vendor's error? - DataBreaches.Net

"After also sending notifications to the affected courts, one of the courts had its local IT vendor call SUCO about the issue. SUCO reportedly told them that the problem was "fixed," but the employee had only relocated the Samba share to another IP address. The client discovered the new IP address within minutes and saw that their data was still exposed. They subsequently instructed SUCO to take the share down."

"So, there was one entity down, but the second entity's larger share was still exposed. DataBreaches emailed the second entity again yesterday. This time, the email was read by someone who immediately recognized it as legitimate and urgent. Within an hour of receiving the email and reviewing our earlier post, the entity instructed SUCO to remove its share entirely. In a follow-up phone call, DataBreaches learned that when the entity had contacted SUCO previously"

Software Unlimited Corp (SUCO) hosted criminal and civil case management systems with unsecured Samba shares exposing confidential and sealed court records. Several notifications to SUCO about exposed client files went unanswered for months. One client's local IT vendor contacted SUCO; SUCO relocated the Samba share to another IP but left the data exposed, and the client ordered the share taken down. A second client removed its share after receiving and promptly verifying an urgent email. SUCO reportedly told clients that alerts were scams and that everything was fine. SUCO clients using hosted deployments should have a security professional investigate their systems.

Read at DataBreaches.Net