FedEx customer records exposed
Kromtech security researchers have discovered an Amazon S3 bucket, set for public access, with sensitive information of thousands of FedEx customers.
The bucket contained 119,000 scanned documents of US and international citizens, including passports, driving licences, and security IDs.
IDs were accompanied by scanned “Applications for Delivery of Mail Through Agent” forms, which contained names, home addresses, phone numbers, and postal codes.
Kromtech concluded that the data belonged to Bongo International, which was bought by FedEx in 2014 and relaunched as FedEx Cross-Border International.
The FedEx Cross-Border service was then shut down in April 2017.
Kromtech said that anyone who used Bongo International’s services between 2009 and 2012 is at risk of having their documents available online.