Santander Consumer Bank, the Belgian branch of the bank, had a misconfiguration in its blog domain that was allowing its files to be indexed.
Source: Santander, one of the biggest European banks, was leaking sensitive data on their website
A Santander Consumer spokesperson said:
“The incident highlighted relates specifically to the Santander Consumer Bank Belgium blog only. The blog contains only public information and articles, and therefore no customer data or critical information from the blog has been compromised. Our security team has already fixed the issue to ensure the blog is secure.”
What exactly is wrong with the Santander website?
When we visited the Santander blog on its Belgian domain, we noticed that the www endpoint of the blog subdomain had a misconfiguration that allowed all of its files to be indexed by search engines
Included in these indexed files was an important info.json file that seemed to contain its Cloudfront API keys.
Download a CyberAware Cheat Sheet
