Personal info of 90k hikers leaked by French tourism company

La Malle Postale, a transportation company serving hikers on popular hiking trails in France, leaked personal data and private messages of their clients.

The Cybernews research team has discovered a data leak on La Malle Postale’s system that exposed the personal data of their clients. The leaked information included names, phone numbers, emails, private communication via SMS messages, passwords, and employees’ credentials.

Founded in 2009, the company provides luggage and passenger transportation services on many popular hiking routes, including the famous Santiago de Compostela pilgrimage trail. The services are well-reviewed by their clients, with an overall four-star rating on TripAdvisor.

Leaked personal data

On January 11th, the Cybernews research team found a publicly accessible datastore with more than 4GB of personal data belonging to the company’s clients.

The leaked personal data included names, emails, and phone numbers of nearly 90,000 customers. The datastore also included more than 13,000 SMS messages sent between the company and its customers.

Researchers also stumbled upon 70,000 customer credentials. Although leaked passwords were not in plain text, they were hashed using the easily crackable WordPress MD5/phpass hashing algorithm.

The exposure of emails and passwords is dangerous, as malicious actors could use them for credential stuffing to try to access other accounts the victim might be using.

The discovered datastore also included the company’s drivers and admin credentials—their emails, passwords, salts used for securing passwords, and authentication tokens.

The employee passwords were left vulnerable to cracking, as they were encoded using the Base64 algorithm. Encoded data can be reversed or decoded back to its original format, so encoding should not be used for storing passwords.

Leaking employee credentials might put the company at risk of targeted cyberattacks. Threat actors could exploit the data to gain access to the company's network and steal sensitive information.

Cybernews tried several times to reach out to the company but at the time of writing has received no reply. According to Cybernews researchers, the access to the datastore was secured at the end of April.

Why is leaking personal data dangerous?

Leaked customer names, emails, phone numbers, and private communication between clients and the company introduces the risk of various cyberattacks.

One of them is identity theft. Fraudsters may exploit the exposed personal information to impersonate the affected individuals and gain access to their financial accounts or other sensitive information. Additionally, criminals could use the data to apply for loans or credit cards in the name of the affected individuals.

Leaked data might also lead to phishing scams. Customers’ personal information might be utilized to craft targeted phishing emails that appear credible and thus increase the likelihood that the recipients will fall for the scam.

Threat actors might also exploit La Malle Postale’s credibility among its clients in social engineering attacks. Criminals might try calling individuals and pretending to be representatives of the company to gain access to sensitive information.

What steps should affected customers take?

If you’ve used the services of La Malle Postale recently or in the past, you should consider the following precautions to minimize risks:

• Change passwords for any accounts that used the same email and password combination that was exposed.
• Avoid reusing the same passwords across multiple accounts.
• Activate two-factor authentication (2FA) where available to add an extra layer of security to your accounts.
• Exercise caution regarding unsolicited emails or messages that request login credentials or personal information. These are likely to be phishing attempts.
• Keep a close eye on financial accounts for any unauthorized transactions and report any suspicious activity immediately.
• Monitor credit reports and credit scores and ensure there are no new accounts opened in your name.