Incident Score: Analysis & Impact (POLDUT1788784548)

In this Rankiteo incident briefing, we review the Polarsteps breach identified under incident ID POLDUT1788784548.

The analysis begins with a detailed overview of Polarsteps's information like the linkedin page: https://www.linkedin.com/company/polarsteps, the number of followers: 18925, the industry type: Technology, Information and Internet and the number of employees: 116 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 767 and after the incident was 590 with a difference of -177 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on Polarsteps and their customers.

Polarsteps recently reported "Polarsteps Travel App Exposes Sensitive Location Data of 23 Million Users, Including Military Personnel", a noteworthy cybersecurity incident.

A major privacy flaw in the Dutch travel app Polarsteps allowed unauthorized access to users' exact locations, photos, and personal details, including those of military personnel from the U.S., U.K., France, and Belgium.

The disruption is felt across the environment, affecting Polarsteps backend API, user data storage, and exposing 230 million photos/videos, 1 billion GPS coordinates, 1 million private trips, with nearly 230 million photos/videos, 1 billion GPS coordinates, 1 million private trips records at risk.

In response, teams activated the incident response plan, moved swiftly to contain the threat with measures like Tightened security measures, manual approval for new followers by default, and began remediation that includes Reduced API data sharing, explored automatic disabling of location tracking, and stakeholders are being briefed through Public response after investigative reporting, no prior user notifications.

The case underscores how Ongoing (post-remediation, but previously scraped data remains in circulation), teams are taking away lessons such as Need for stricter API access controls, explicit user consent for data sharing, better risk assessment for privacy flaws, and proactive security measures for high-risk users (e.g., military personnel), and recommending next steps like Implement stricter API rate limiting and authentication, Require explicit user consent for follower requests and Automatically disable location tracking for sensitive locations (e.g., home, work), with advisories going out to stakeholders covering Dutch Ministry of Defence banned Polarsteps on defense devices and warned personnel about risks on personal phones.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.