Pierluigi Paganini
August 31, 2023
The National Safety Council has leaked nearly 10,000 emails and passwords of their members, exposing 2000 companies, including governmental organizations and big corporations.
The National Safety Council (NSC) is a non-profit organization in the United States providing workplace and driving safety training. On its digital platform, NSC provides online resources for its nearly 55,000 members spread across different businesses, agencies, and educational institutions.
However, the organization’s website was left vulnerable to cyberattacks for five months. The Cybernews research team discovered public access to the web directories that exposed thousands of credentials.
Among a long list of leaked credentials were employees of around 2000 companies and governmental entities, including:
These companies likely held accounts on the platform to access training materials or participate in events organized by the NSC.
The vulnerability posed a risk not only to NSC systems but also to the companies using NSC services. Leaked credentials could have been used for credential stuffing attacks, which try to log into companies’ internet-connected tools such as VPN portals, HR management platforms, or corporate emails.
Also, the credentials could have been used to gain initial access into corporate networks to deploy ransomware, steal or sabotage internal documents, or gain access to user data. Cybernews reached out to the NSC, and it quickly fixed the issue.
The discovery of the vulnerability was made on March 7th. The Cybernews research team found a subdomain of the NSC website, which was likely used for development purposes. It exposed the listing of its web directories to the public, enabling an attacker to access the majority of files crucial for the operation of the web server. Among the accessible files, researchers also discovered a backup of a database storing user emails and hashed passwords. The data was publicly accessible for 5 months, as the leak was first indexed by IoT search engines on January 31st, 2023.
In total, the backup stored around 9500 unique accounts and their credentials, with nearly 2000 different corporate email domains belonging to companies spreading across various industries.
Having a development environment accessible to the public shows poor development practices. Such environments should be hosted separately from the production environment’s domain and must refrain from hosting actual user data, and, of course, it should not be publicly accessible.
As a huge number of emails were leaked, platform users could potentially experience a surge in spam and phishing emails. It’s advisable for them to externally verify the information contained in emails and exercise caution when clicking links or opening attachments.
Give a look at the original post @
Original post at
About the author: , Journalist at CyberNews
Follow me on Twitter: and and Mastodon
(SecurityAffairs – National Safety Council, NASA)
