Openprovider exposed transfer codes, registrant data in data leak — Domain registrar
Security researchers found 164GB of exposed data from ICANN-accredited registrar, counting sensitive domain transfer codes.
ICANN-accredited registrar Openprovider accidentally leaked sensitive domain name and client data, researchers recently discovered.
Bob Diachenko, a cybersecurity researcher and owner at Security Discovery, and Cybernews discovered a publicly exposed Elasticsearch instance containing 164GB of data from the registrar.
The data included transfer authorization codes, which could have allowed attackers to transfer away domains if the domains did not have transfer lock activated.
It also included domain registrants’ contact information, counting email addresses and phone numbers, which could have been used for nefarious purposes.
Openprovider fixed the issue following the researchers informed the registrar of the issue in early April. The registrar told Cybernews that the data was openly available for regarding three months.
The registrar is accredited by ICANN as Hosting Concepts B.V. d/b/a Register.eu. It is a sizable registrar with regarding 800,000 .com domain names registered as of February of this year.
Openprovider offers a reseller model and memberships, where registrants can get domains at cost with a monthly membership fee.
The firm told the security researchers that it would inform clients of the issue in one of its regularly scheduled newsletters. I can’t find any mention of it in Openprovider’s archived newsletters. Still, on Friday, following Cybernews published regarding the data leak, the firm sent an email to clients.
OpenProvider confirmed that it does not believe the data was accessed by anyone. It also apologized for not letting clients know regarding the incident sooner. The email stated:
You may have seen in trade publications that a few weeks ago, we were made aware of a vulnerability in our software by a cybersecurity researcher. Fortunately, our investigations indicate that no data was leaked. We are grateful to the cybersecurity researcher for bringing this issue to our attention.
At that time, we failed to inform our clients promptly. We deeply regret this delay and sincerely apologize for our oversight.
This incident served as a critical wake‑up call regarding both our communication practices and data security. We promptly resolved the vulnerability and secured the system. We have also strengthened our internal protocols for software security and vulnerability reporting to the highest standard.
We remain confident that no data was compromised. Had any data been leaked, we would have detected it within our systems in the following weeks. Nevertheless, if you have any concerns regarding a potential data breach affecting you, please let us know so we can work together on a resolution. Ought to you have any other questions, we are here to help.
