Iranian Crypto Exchange Misstep Exposes User Details

A misconfigured object storage system used by Iranian crypto exchange bit24.cash has exposed the personal details of approximately 230,000 citizens in Iran.

Researchers from Cybernews reported that the oversight in bit24.cash's MinIO left unprotected and open online S3 buckets storing users' verification documents, including consent letters, passport information, and credit card details. MinIO is an S3-compatible open source object storage system that handles unstructured data.

Hossein Amini, security engineer at bit24.cash, told Cybernews there was no evidence of a data breach or unauthorized access to that sensitive user information, and user security and data protection are "utmost priorities." The researchers confirmed that the storage instance has now been secured and is no longer accessible.

Unsecured access to S3 buckets has been the cause for a number of breaches, including a 2022 case where 3TB of airport data was left exposed.