Tesco shutters parking app following license plate image leak

British supermarket chain Tesco has discontinued its park verification web app The registry Millions of Automatic Number Plate Recognition (ANPR) images were uncovered in a Microsoft Azure blob.

The images themselves consisted of photos of cars taken on entering and leaving 19 company parking garages across the country. While the drivers of these vehicles were not visible in the photos, their license plates were.

The Azure Blob, which operated Tesco's outsourced Park Verification Web App, had no login or authentication controls and was fully accessible. The company admitted The registry that these time stamped images were uncovered during a data migration exercise.

Ranger Services, who ran the Azure Blob for Tesco's Web App, is investigating the extent of the security breach. Following the recent merger with competing park operator CP Plus, the company is now named GroupNexus.

Illuminated ANPR images

The Azure blob contained ANPR live images saved as time-stamped JPEG files, and the time customers turned their cars off was also included in the image file names. Anyone who is able to correctly determine the format of the required HTTP POST request could have collected the images for unauthorized use in bulk.

A Tesco spokesman explained what happened The registry, Saying:

"A technical problem with a park app meant that historical images and times of cars entering and leaving our parking lots were accessible for a short period of time. Although neither personal photos nor confidential data were available, a security breach is unacceptable. We've now disabled the app while working with our service provider to make sure it does not happen again. "

READ  The best iPhone 7 deals in October 2019

According to the company, the Azure blob was left open during a scheduled data migration exercise into an AWS data lake. It was secured, but Tesco did not want to reveal how long it was left open.

As Tesco has purchased the parking space monitoring services from a third party, the third party, according to the company, is responsible for protecting the data it collects and stores in accordance with the law.

About the registry

Spread the good stuff:
This post contains affiliate links, to find out more information, please read our disclaimer.
The price written on this page is true as the time it is written. It may change at any moment.

Related Posts