This UK pub chain left 17,000 customer details exposed online
The personal details of thousands of beer drinkers were left exposed thanks to a Wi-Fi provider proving leakier than a smashed pint glass.
Brewhouse & Kitchen is a small chain of pubs with 23 locations across the UK. These include locations in London, Nottingham, Chester, Cardiff and Bristol.
Patrons attempting to access its free Wi-Fi were asked to hand over their names, emails, date of birth, phone numbers and other personal details. Oliver Hough, an independent security researcher, stumbled across a spreadsheet file containing more than 17,000 such records on an open directory hosted by Brewhouse's Wi-Fi provider, Focus Group.
"Looking for potential data breaches is somewhat of a hobby, at the time I was looking for open directories," he says. Finding the open directory was "pretty easy as the server was indexed on the Shodan search engine." Shodan is a search engine for internet connected devices, handy for researchers looking for anything that shouldn't be online.
The Brewhouse database included which pub the users logged into and when — and whether the customer wanted to be added to marketing lists (the majority of people said). "Phone numbers, email addresses could be used in scams or phishing campaigns," Hough says. "The other details such as date of birth, device type etc can be used to add legitimacy to a scam."
There's nothing to suggest scammers or hackers have downloaded the data. It was merely left exposed online for anyone with the technical know how to access.
Hough contacted Brewhouse on November 9; five days later, the directory was removed from open access. Both companies said they've contacted the Information Commissioner's Office (ICO) to report the incident.
"Focus Group were made aware of a possible breach of Brewhouse & Kitchen's data on November 14 2018. We have subsequently followed our GDPR policy and are in the process of notifying the ICO," Focus Group's director Vicki Rishbeth said in an emailed statement.
Brewhouse & Kitchen said in a statement that it had worked with Focus Group to identify the source of the breach and stopped the leak. "We consider the management of our customers’ personal data to be the utmost priority, the incident in question has prompted a stringent review of the systems and infrastructure in place across all of our sites by our contracted service provider, ensuring a repeat or similar situation cannot arise again," the statement added.
source wired
Industry: Cyber Security News

Latest Jobs
-
- SOC Manager. SC Clearance. Immediate opportunity.
- Unknown
- N/A
-
Permanent SOC Manager. SC cleared / clearable, London / Birmingham. SOC Manager needed to replace a SOC contractor I placed into a client who is due to complete their assignment at the end of March. The ability to achieve SC clearance is essential. Looking for someone that is a blend of strategic stakeholder engagement with strong technical skills. The role will sit in a relatively new SOC environment. The position is to setup, implementation and management of resources to help with the initial and on-going stages of a new SOC. Experience engaging with and managing client stakeholder relationships as well as 3rd party relationships is critical. The role will involve; setting up, implementing and fine tuning the various initial stages of a SOC environment. Experience establishing and building out technical process / operational capability, managing of technical teams (analysts, engineers and architects, creation of policy / playbooks, fine turning is key. SPLUNK is the tooling of choice… Interviewing immediately. Set up a call with me today on https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-manager-role Direct contact details Chris.Holt@dclsearch.com or 07884666351
-
- Security engineer. Financial Services. UK. Permanent
- Unknown
- N/A
-
CH7863 Security engineer. End User . Financial Services Security Engineer needed to monitor and manage a security suite of tools within an End User environment. The Security Engiener will be responsible monitoring, configuring, fine tuning, incident management and generally improving the security tool capability. Specific experience with CyberArk, Tripwire Log Center and Tripwire Enterprise is highly desirable). Current experience with Vulnerability management and penetration testing is highly desirable. Specifically the ability to effectively manage 3rd party pen tests. You will be working within a specialist security team reporting to the CISO. Experience working within an end user environment within financial services is highly desirable. Flexible location. This is an exclusive role to DCL Search & Selection. To book a call please use my Calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-role-
-
- DevSecOps - Security design / review consultant. SC Clearance. London
- London
- N/A
-
CH7858 London £70,000 DevSecOps - Security design / review consultant. DevSecOps - Security design / review consultant will ensure that newly created, public facing apps are secure by design and by default by aligning them to current / best practice security policies and standards into the design phases. The individual must have a technical software / application development background with specalist experinece in secure architecture design. (Frameworks, processes, best practice etc) Practical experience translating and ensuring that the OWASP top 10, ISO27001, HMG frameworks requirements are reviewed and embedded into project designs which are implemented is essential. Experience working projects through a full development lifecycle is key. You will work along side the design and project teams to idenitfy and mitigate risks throughout the design phases. This is a permanent role. SC clearance is essential as is the ability to get to the London office. (When appropiate #covid) Security DevSecOps consultant. To arrange a discreet call book via https://calendly.com/chris-holt/devsecopp--security-design-review-consultant
-
- CONTRACTOR Cyber Vulnerability Analyst, NESSUS, Rapid 7, SC clearance required.
- London
- N/A
-
Cyber Vulnerability analyst NESSUS, Rapid 7, needed for IMMEDIATE 3 month contract MUST have / be able to achieve UK SC clearance role to work within a live environment within a public sector department. The individual must have experience in using various security methods and tools such as Rapid7 and NESSUS scan for / identify vulnerabilities, prioritise them according to risk and raise appropriate tickets for remediation / follow up. In depth experience utilising Nessus highly beneficial. Current cyber public sector experience highly desirable.