In a recent cybersecurity incident, an employee’s error led to the inadvertent exposure of personal data related to a subset of VirusTotal’s registered customers. This data included names and email addresses, with the database comprising approximately 5,600 names housed in a 313KB file.
VirusTotal, a service widely used to detect malware and malicious content in suspicious files and URLs, experienced this lapse despite being a subsidiary of Google Cloud’s Chronicle unit. Google has confirmed the incident, noting immediate action was taken to remove the exposed data.
Interestingly, the leaked data includes accounts tied to significant U.S. entities such as the Cyber Command, Department of Justice, FBI, and the NSA. Several government agencies from countries like Germany, the Netherlands, Taiwan, and the U.K. were also impacted. This underscores the critical importance of fortifying internal cybersecurity measures and continually reviewing processes to prevent such errors.
The event serves as a real-world reminder of warnings such as that from Germany’s Federal Office for Information Security (BSI) last year, cautioning against the automation of suspicious email attachment uploads due to the potential exposure of sensitive information.