The Joomla Team Announced a Security Breach Caused by an Unencrypted Backup
The developers running Joomla, an open-source project and one of the most popular content management systems in the world, reported a data breach last week. A now-former member of the team uploaded a backup of the entire Joomla Resources Directory website to an unprotected Amazon Web Service (AWS) S3 bucket. Included in the backup were the details of about 2,700 registered users. The Joomla team decided not to sweep the breach under the carpet, and the incident was described in a rather detailed notification. Some might think that this is a strange decision.
Most of the exposed data was publicly accessible anyway
Most of the affected accounts are owned by developers who use the website to advertise their skills and services. The exposed details included names, email addresses, physical addresses, phone numbers, company websites, newsletter subscription preferences, IP addresses, and hashed passwords. Everything apart from the passwords was in plaintext, and the entire backup was not encrypted.
This is not a very good thing, but it must be said that the affected users don't have that much to worry about. Most of the information was publicly accessible anyway, so although there's no information on whether or not anyone has accessed the exposed backup, the potential impact of this particular data breach is rather low.
The poor backup handling is not a good look
Despite the relatively low severity of the breach, the Joomla team appears to be taking the incident seriously. And so they should.
As ZDNet pointed out, up until very recently, Joomla was the second most popular content management system in the world, and although it's nowhere near as big as WordPress, the number of websites that are based on it sits at well over 2 million. The responsibility for the people who run the project is pretty huge, and allowing unencrypted backups to leak like that is simply not acceptable.
Luckily, the breach was followed by a security audit, and the team assures us that a number of changes to the policies and procedures have been implemented. It's definitely a better-late-than-never situation, and we're hoping that the developers of other projects of this size will learn from Joomla's mistakes and will take the necessary precautions before any data is exposed.
