MyCastingFile.com is an online casting agency that recruits talent.
Through its website, people can sign up, and apply for casting notices. The company claims to have provided talented individuals for films like True Detective, Pitch Perfect, NCIS: New Orleans, and Terminator Genisys.
And this time, the New Orleans-based company has been inadvertently exposing the data of roughly 260,000 individuals through an unsecured database.
Discovered by the cybersecurity team at Safety Detectives, the team's leader Anurag Sen said that the breach was discovered at the beginning of June 2020.
The researchers found an open Elasticsearch server, hosted by Google Cloud, in the United States. The database was not secured by any form of authentication.
The database was 1GB in size.
Upon investigation, the team found that the hundreds of thousands of users that were exposed, include both the data of aspiring actors and potentially members of MyCastingFile staff.
According to the team's report in a blog post, the data that leaked include: personally identifiable information, such as names, physical addresses, email addresses, phone numbers, work histories, dates of birth, height and weight, ethnicity, and physical features like hair color and length.
In addition, the database also has data about users' vehicle ownership information, such as model, color, and year of manufacture.
Making things worse, the database also leaked the faces and bodies of users. It should be noted however, that only some of the images were exposed as they were hosted on multiple locations and via different cloud services.
MyCastingFile also allow users under 18 years of age, as long as their accounts are managed by their guardians, or if they have been consent.
From the data breach, it could have been possible to determine what amount of data belonged to children, although our security team did not carry out a full download or demographic analysis of the available data — first and foremost, for ethical reasons."
