Open V exposure: 9,000 client call recordings sat open for two months
third-party IT supplier exposed call recordings, databases and logins

Open V exposure: 9,000 client call recordings sat open for two months

A Gqeberha IT company left more than 9,000 recorded client calls open on the internet for about two months, in the same directory tree as databases, usernames, passwords and proprietary source code.

What happened

GroundUp found the material on an Open V server on Wednesday night using Shodan, a search engine for internet-connected hosts. No password guessing was involved: the directories were simply reachable and listed. The recordings date back to 27 July and appear to have been publicly indexed since 6 September, so the exposure ran for roughly two months before anyone with authority over the system noticed.

At least 1,900 of the audio files are substantial calls rather than dropped connections. Where the callers could be identified, the recordings were inbound, outbound or internal to Edge Financial Group, a Gqeberha financial services firm that brokers medical scheme cover, and many involved medical scheme queries to Discovery or Bonitas.

The files were pulled offline after GroundUp contacted the companies. Open V's attorneys dispute the attribution of responsibility and argue that an accessible directory does not by itself establish who owned or configured the system.

Who is affected

  • Edge Financial Group clients whose medical scheme and financial conversations were recorded
  • Any business that outsources call recording, CRM hosting or database administration to a smaller IT provider
  • South African companies whose supplier holds their customer data: POPIA keeps the notification duty with you, not with the supplier

What to do now

Ask your IT provider, in writing, which of your data sets are reachable from the public internet, and verify the answer yourself instead of accepting an assurance.

  • Scan your own public IP ranges with Shodan or Censys and look for directory listings, open storage paths and exposed admin panels
  • Require that archives and buckets are authenticated, not merely unlisted; unlisted is not protected
  • Check where call recordings, exports and backups physically live, and who besides you can read them
  • If you find exposure, treat it as a POPIA section 22 security compromise and notify the Information Regulator and affected data subjects

What this means for South African businesses

Most South African SMEs hand call recording, backups and line-of-business hosting to a small IT firm or software vendor, and then stop looking. This exposure lived on an indexed host for two months, which means discovery required no skill at all, only a search. In practice an SME is now more likely to be breached through a supplier's configuration mistake than through its own firewall, and under POPIA the responsible party still carries the notification duty even when the operator caused the leak.

Source: GroundUp, Your call is being recorded and broadcast to the internet.

Refrigeration Controllers Under Active Attack, US Agencies Warn Cold Chain
Internet-exposed temperature controllers forced into heating and defrost cycles at supermarkets and cold stores