ZDNet reports that real-time GPS coordinates for more than 11,000 Indian buses were left published on the internet for weeks. Security Researcher Justin Paine reported that the data breach resulted from an unprotected ElasticSearch server that contained aggregated data from 27 state-owned transportation agencies. Paine confirmed the server was accessible from at least 30 Nov. 2018, but said it was unclear how long the server existed prior to that date and noted that he could not determine who owned the data.
Full Story