databreach infosec misconfigurations UAE World

UAE: IT service provider for Dubai Duty Free With DataBreach

diciembre 12, 2025 0

UAE: IT service provider for Dubai Duty Free With DataBreach

Today we're talking about a commercial enterprise located in the United Arab Emirates. This information came from an IT service provider for Dubai Duty Free called touchworldtechnology.

Dubai Duty Free (DDF) is a retail operation at Dubai International Airport (DXB) and Al Maktoum International Airport (DWC), recognized worldwide as one of the largest and most successful duty-free shops in the world.

What data was exposed?

Here you can see the open directory when it was exposed

An open directory containing 90GB of information was exposed at the time, likely due to an error or misconfiguration.

While reviewing the folders, I found data that shouldn't have been publicly exposed. According to my information, this data had been exposed since the beginning of the year. I discovered it in early September, so imagine how long it had been exposed.

What files did that open directory contain?

A ship bill internal document from Dubai Duty Free

At first, I saw Excel spreadsheets, invoices, test invoices—irrelevant things—but as I continued, I saw passports -id cards, which started to worry me. I also saw an env file containing the entire MySQL database configuration with its username and password, as well as the configuration of the bucket on http://digitaloceanspaces.com with its access key and secret.

So, someone backup the bucket and left it exposed?

Notification:

I sent an email to DDF on September 3rd warning them about this situation. When I saw that no one responded, I sent an email to the AE Computer Emergency Response Team (AECERT) on September 5th. No one replied, but on September 10th, I received an email thanking me for my concern and saying they would forward the email to the appropriate department.

This was closed on September 13th, according to my follow-up.

<script src='https://www.blogger.com/static/v1/jsbin/1345082660-comment_from_post_iframe.js' type='text/javascript'></script>

  
    <script>
const cookieContainer = document.querySelector(".cookie-container");
const cookieButton = document.querySelector(".buttons .item");
cookieButton.addEventListener("click", () => {
cookieContainer.classList.remove("active");
localStorage.setItem("cookieBannerDisplayed", "true");
});
setTimeout(() => {
if (!localStorage.getItem("cookieBannerDisplayed")) {
cookieContainer.classList.add("active");
}
}, 2000);
</script>

<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/1581542668-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AOuZoY7gLtPSWX2pEWfzd3rHqBtCio1qSg:1765751548321';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d9218358485248989521','//www.security-chu.com/2025/12/IT-service-provider-for-Dubai-Duty-Free-With-DataBreach.html','9218358485248989521');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '9218358485248989521', 'title': 'Blog de Ciberseguridad en Latinoam\xe9rica: ', 'url': 'https://www.security-chu.com/2025/12/IT-service-provider-for-Dubai-Duty-Free-With-DataBreach.html', 'canonicalUrl': 'https://www.security-chu.com/2025/12/IT-service-provider-for-Dubai-Duty-Free-With-DataBreach.html', 'homepageUrl': 'https://www.security-chu.com/', 'searchUrl': 'https://www.security-chu.com/search', 'canonicalHomepageUrl': 'https://www.security-chu.com/', 'blogspotFaviconUrl': 'https://www.security-chu.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': true, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'G-QLVYKK7S0N', 'analytics4': true, 'encoding': 'UTF-8', 'locale': 'es', 'localeUnderscoreDelimited': 'es', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Blog de Ciberseguridad en Latinoam\xe9rica:  - Atom\x22 href\x3d\x22https://www.security-chu.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22Blog de Ciberseguridad en Latinoam\xe9rica:  - RSS\x22 href\x3d\x22https://www.security-chu.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Blog de Ciberseguridad en Latinoam\xe9rica:  - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/9218358485248989521/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Blog de Ciberseguridad en Latinoam\xe9rica:  - Atom\x22 href\x3d\x22https://www.security-chu.com/feeds/4231462689104601877/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseClientId': 'ca-pub-7633352484134729', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'adsenseAutoAds': true, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/ce4a0ba1ae8a0475', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Obtener enlace', 'key': 'link', 'shareMessage': 'Obtener enlace', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Compartir en Facebook', 'target': 'facebook'}, {'name': 'Escribe un blog', 'key': 'blogThis', 'shareMessage': 'Escribe un blog', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': 'Compartir en X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Compartir en Pinterest', 'target': 'pinterest'}, {'name': 'Correo electr\xf3nico', 'key': 'email', 'shareMessage': 'Correo electr\xf3nico', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27es\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': true, 'jumpLinkMessage': 'Read more \xbb', 'pageType': 'item', 'postId': '4231462689104601877', 'postImageThumbnailUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkMkdwsBJ9zVlANxJlj2PlTeGaK1lsCdReDwB0D1RCrWZOYHONMQJZmaxA1nKx0nQjNS85pfH6PVr452NycAKmluA8kYfi96-_RjiZ7ITn7xsyRndK-3I9gBPZhaYGzdcjIT7hYqk_ZCH9wznjlZe98PgPX0Kw1hIjz8FuS-fzScGy23SiMn85SxDZlWo/s72-w400-c-h284/2025-12-11%2023_14_01-image-1694153838112.pdf%20-%20Adobe%20Acrobat%20Reader%20(64-bit).png', 'postImageUrl': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkMkdwsBJ9zVlANxJlj2PlTeGaK1lsCdReDwB0D1RCrWZOYHONMQJZmaxA1nKx0nQjNS85pfH6PVr452NycAKmluA8kYfi96-_RjiZ7ITn7xsyRndK-3I9gBPZhaYGzdcjIT7hYqk_ZCH9wznjlZe98PgPX0Kw1hIjz8FuS-fzScGy23SiMn85SxDZlWo/w400-h284/2025-12-11%2023_14_01-image-1694153838112.pdf%20-%20Adobe%20Acrobat%20Reader%20(64-bit).png', 'pageName': 'UAE: IT service provider for Dubai Duty Free With DataBreach', 'pageTitle': 'Blog de Ciberseguridad en Latinoam\xe9rica: : UAE: IT service provider for Dubai Duty Free With DataBreach', 'metaDescription': 'When you\x27re a large company and your service provider leaves bucket keys and MySQL passwords exposed...'}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Editar', 'linkCopiedToClipboard': 'El enlace se ha copiado en el Portapapeles.', 'ok': 'Aceptar', 'postLink': 'Enlace de la entrada'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Personalizado', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'UAE: IT service provider for Dubai Duty Free With DataBreach', 'description': 'When you\x27re a large company and your service provider leaves bucket keys and MySQL passwords exposed...', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkMkdwsBJ9zVlANxJlj2PlTeGaK1lsCdReDwB0D1RCrWZOYHONMQJZmaxA1nKx0nQjNS85pfH6PVr452NycAKmluA8kYfi96-_RjiZ7ITn7xsyRndK-3I9gBPZhaYGzdcjIT7hYqk_ZCH9wznjlZe98PgPX0Kw1hIjz8FuS-fzScGy23SiMn85SxDZlWo/w400-h284/2025-12-11%2023_14_01-image-1694153838112.pdf%20-%20Adobe%20Acrobat%20Reader%20(64-bit).png', 'url': 'https://www.security-chu.com/2025/12/IT-service-provider-for-Dubai-Duty-Free-With-DataBreach.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 4231462689104601877}}, {'name': 'widgets', 'data': [{'title': 'Blog de Ciberseguridad en Latinoam\xe9rica:  (cabecera)', 'type': 'Header', 'sectionId': 'header', 'id': 'Header51'}, {'title': 'Menu', 'type': 'PageList', 'sectionId': 'header', 'id': 'PageList51'}, {'title': 'Entradas del blog', 'type': 'Blog', 'sectionId': 'Hero', 'id': 'Blog99', 'posts': [{'id': '4231462689104601877', 'title': 'UAE: IT service provider for Dubai Duty Free With DataBreach', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkMkdwsBJ9zVlANxJlj2PlTeGaK1lsCdReDwB0D1RCrWZOYHONMQJZmaxA1nKx0nQjNS85pfH6PVr452NycAKmluA8kYfi96-_RjiZ7ITn7xsyRndK-3I9gBPZhaYGzdcjIT7hYqk_ZCH9wznjlZe98PgPX0Kw1hIjz8FuS-fzScGy23SiMn85SxDZlWo/w400-h284/2025-12-11%2023_14_01-image-1694153838112.pdf%20-%20Adobe%20Acrobat%20Reader%20(64-bit).png', 'showInlineAds': false}], 'footerBylines': [{'regionName': 'footer1', 'items': [{'name': 'author', 'label': 'Publicado por'}, {'name': 'timestamp', 'label': 'en'}, {'name': 'comments', 'label': 'comentarios'}]}, {'regionName': 'footer2', 'items': [{'name': 'labels', 'label': 'Etiquetas:'}]}, {'regionName': 'footer3', 'items': [{'name': 'location', 'label': 'Ubicaci\xf3n:'}]}], 'allBylineItems': [{'name': 'author', 'label': 'Publicado por'}, {'name': 'timestamp', 'label': 'en'}, {'name': 'comments', 'label': 'comentarios'}, {'name': 'labels', 'label': 'Etiquetas:'}, {'name': 'location', 'label': 'Ubicaci\xf3n:'}]}, {'title': '{ content: \x22carousel\x22, top: 2 }', 'type': 'PopularPosts', 'sectionId': 'upper', 'id': 'PopularPosts52', 'posts': [{'title': 'Negociaciones con el grupo de ransomware Akira: un enfoque desaconsejado', 'id': 9124550943780027656}, {'title': '-Update-Ciberataque:La Universidad Mayor atacada por el grupo Dire Wolf ransomware - Chile', 'id': 2146765111535097903}, {'title': 'Hack: Exclusivo The Crimson Collective afirma haber hackeado a Claro Colombia', 'id': 3615796226669920942}, {'title': 'Bolivia: Minera San Crist\xf3bal S.A, afectada por ransomware? el grupo Bashe reclama un rescate y filtra datos', 'id': 2032377835755402294}, {'title': 'Chile: Instituto Oncologico Fundacion Arturo Lopez Perez (FALP) Golpeado con ransomware', 'id': 4468558058494053250}, {'title': 'Chile: Klap plataforma de pago es publicado en un foro de hacking por actor malicioso dice tener 158,795 datos.', 'id': 7282432470528731753}, {'title': 'Se confirma el ataque de ransomware akira a la Agencia Aduanera Browne.cl ', 'id': 7361480720066391578}, {'title': 'Update:Gunra Filtra los datos en la Dark Web de la licorera Varela Hermanos - Panam\xe1', 'id': 3462408777546039410}, {'title': 'Safepay ransomware activo en latinoam\xe9rica: Funeraria cali.losolivos.co, Centro M\xe9dico JockeySalud, Moto Mec\xe1nica Argentina S.A', 'id': 3586143683914647174}, {'title': 'Parte 2: Safepay ransomware libera informaci\xf3n robada de la Escuela Especializada en Ingenier\xeda ITCA-FEPADE en El Salvador.', 'id': 2972940980987668924}]}, {'title': 'Entradas del blog', 'type': 'Blog', 'sectionId': 'Content', 'id': 'Blog1', 'posts': [{'id': '4231462689104601877', 'title': 'UAE: IT service provider for Dubai Duty Free With DataBreach', 'featuredImage': 'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkMkdwsBJ9zVlANxJlj2PlTeGaK1lsCdReDwB0D1RCrWZOYHONMQJZmaxA1nKx0nQjNS85pfH6PVr452NycAKmluA8kYfi96-_RjiZ7ITn7xsyRndK-3I9gBPZhaYGzdcjIT7hYqk_ZCH9wznjlZe98PgPX0Kw1hIjz8FuS-fzScGy23SiMn85SxDZlWo/w400-h284/2025-12-11%2023_14_01-image-1694153838112.pdf%20-%20Adobe%20Acrobat%20Reader%20(64-bit).png', 'showInlineAds': false}], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': ''}]}, 'footerBylines': [{'regionName': 'footer1', 'items': [{'name': 'comments', 'label': 'comments'}]}, {'regionName': 'footer2', 'items': [{'name': 'labels', 'label': ''}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': ''}, {'name': 'comments', 'label': 'comments'}, {'name': 'labels', 'label': ''}]}, {'title': 'Puedes seguirnos en nuestras redes sociales', 'type': 'HTML', 'sectionId': 'sidebar', 'id': 'HTML3'}, {'title': 'Translate', 'type': 'HTML', 'sectionId': 'sidebar', 'id': 'HTML2'}, {'title': '', 'type': 'HTML', 'sectionId': 'sidebar', 'id': 'HTML1'}, {'title': 'Search', 'type': 'BlogSearch', 'sectionId': 'sidebar', 'id': 'BlogSearch51'}, {'title': '{ title: \x22Trending\x22, content: \x22trending\x22 }', 'type': 'PopularPosts', 'sectionId': 'sidebar', 'id': 'PopularPosts53', 'posts': [{'title': 'Negociaciones con el grupo de ransomware Akira: un enfoque desaconsejado', 'id': 9124550943780027656}, {'title': '-Update-Ciberataque:La Universidad Mayor atacada por el grupo Dire Wolf ransomware - Chile', 'id': 2146765111535097903}, {'title': 'Hack: Exclusivo The Crimson Collective afirma haber hackeado a Claro Colombia', 'id': 3615796226669920942}, {'title': 'Bolivia: Minera San Crist\xf3bal S.A, afectada por ransomware? el grupo Bashe reclama un rescate y filtra datos', 'id': 2032377835755402294}, {'title': 'Chile: Instituto Oncologico Fundacion Arturo Lopez Perez (FALP) Golpeado con ransomware', 'id': 4468558058494053250}, {'title': 'Chile: Klap plataforma de pago es publicado en un foro de hacking por actor malicioso dice tener 158,795 datos.', 'id': 7282432470528731753}, {'title': 'Se confirma el ataque de ransomware akira a la Agencia Aduanera Browne.cl ', 'id': 7361480720066391578}, {'title': 'Update:Gunra Filtra los datos en la Dark Web de la licorera Varela Hermanos - Panam\xe1', 'id': 3462408777546039410}, {'title': 'Safepay ransomware activo en latinoam\xe9rica: Funeraria cali.losolivos.co, Centro M\xe9dico JockeySalud, Moto Mec\xe1nica Argentina S.A', 'id': 3586143683914647174}, {'title': 'Parte 2: Safepay ransomware libera informaci\xf3n robada de la Escuela Especializada en Ingenier\xeda ITCA-FEPADE en El Salvador.', 'id': 2972940980987668924}]}, {'title': 'Example', 'type': 'HTML', 'sectionId': 'sidebar-post', 'id': 'HTML55'}, {'title': 'Example', 'type': 'HTML', 'sectionId': 'sidebar-page', 'id': 'HTML56'}, {'title': 'Modo', 'type': 'Text', 'sectionId': 'Filters', 'id': 'Text52'}, {'title': 'Orden', 'type': 'Text', 'sectionId': 'Filters', 'id': 'Text53'}, {'title': 'T\xe9rminos', 'type': 'BlogSearch', 'sectionId': 'Filters', 'id': 'BlogSearch52'}, {'title': 'Copyright', 'type': 'HTML', 'sectionId': 'footer-upper', 'id': 'HTML57'}, {'title': 'Footer links', 'type': 'PageList', 'sectionId': 'footer-lower', 'id': 'PageList52'}]}]);
_WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header51', 'header', document.getElementById('Header51'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PageListView', new _WidgetInfo('PageList51', 'header', document.getElementById('PageList51'), {'title': 'Menu', 'links': [{'isCurrentPage': false, 'href': 'https://www.security-chu.com/', 'id': '0', 'title': 'Inicio'}, {'isCurrentPage': false, 'href': 'https://www.security-chu.com/p/quien-soy.html', 'id': '6582048975581469329', 'title': 'Quien Soy'}], 'mobile': false, 'showPlaceholder': true, 'hasCurrentPage': false}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog99', 'Hero', document.getElementById('Blog99'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/1633826892-lbx__es.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/828616780-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PopularPostsView', new _WidgetInfo('PopularPosts52', 'upper', document.getElementById('PopularPosts52'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'Content', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/1633826892-lbx__es.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/828616780-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML3', 'sidebar', document.getElementById('HTML3'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML2', 'sidebar', document.getElementById('HTML2'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML1', 'sidebar', document.getElementById('HTML1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogSearchView', new _WidgetInfo('BlogSearch51', 'sidebar', document.getElementById('BlogSearch51'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PopularPostsView', new _WidgetInfo('PopularPosts53', 'sidebar', document.getElementById('PopularPosts53'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML55', 'sidebar-post', document.getElementById('HTML55'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML56', 'sidebar-page', document.getElementById('HTML56'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_TextView', new _WidgetInfo('Text52', 'Filters', document.getElementById('Text52'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_TextView', new _WidgetInfo('Text53', 'Filters', document.getElementById('Text53'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogSearchView', new _WidgetInfo('BlogSearch52', 'Filters', document.getElementById('BlogSearch52'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML57', 'footer-upper', document.getElementById('HTML57'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PageListView', new _WidgetInfo('PageList52', 'footer-lower', document.getElementById('PageList52'), {'title': 'Footer links', 'links': [{'isCurrentPage': false, 'href': 'https://www.security-chu.com/p/cookies.html', 'id': '6860183368756218029', 'title': 'Cookies'}, {'isCurrentPage': false, 'href': 'https://www.security-chu.com/p/politicas-de-privacidad.html', 'id': '5871657687021101664', 'title': 'Politicas de Privacidad'}, {'isCurrentPage': false, 'href': 'https://www.security-chu.com/p/aviso-legal.html', 'id': '5281408907494033200', 'title': 'Aviso Legal'}], 'mobile': false, 'showPlaceholder': true, 'hasCurrentPage': false}, 'displayModeFull'));
</script>
</body>