System Misconfiguration exposes record label Empire Distribution data
Learn More
Empire Distribution, a prominent independent record label known for its work with major artists in the hip-hop scene, has exposed sensitive data due to misconfiguration. Cybernews researchers have found the data in a publicly accessible environment file.
The publicly accessible .env file contained critical credentials including:
- JSON Web Token (JWT) secrets,
- Mailgun API and domain details,
- SES key and secret,
- multiple database credentials,
- Memcached server credentials.
The exposed credentials could potentially allow unauthorized access to Empire Distribution’s systems and compromise sensitive information such as customer data, financial records, or intellectual property. With access to the database credentials, attackers could potentially move laterally within the network, leading to more extensive breaches.
The leakage of Mailgun and SES credentials could enable attackers to send emails on behalf of Empire Distribution, potentially leading to phishing attacks or the spread of malware.
It's unclear how long the file was available online and whether it was abused. Empire Distribution secured the file but has not issued a comment.
