Ottawa Protest Donation Site Exposes Donor Passports and Licenses
A security lapse on the GiveSendGo fundraising platform exposes highly sensitive identity documents of donors to the Ottawa trucker protest.
A donation site used by truckers protesting vaccine mandates in Ottawa fixes a major security lapse that exposes donor passports and driver licenses. GiveSendGo becomes the primary fundraising platform for the "Freedom Convoy" after GoFundMe freezes millions of dollars, citing reports of violence and harassment. The protest paralyzes Canada's capital city as thousands gather to oppose mandatory COVID-19 vaccinations.
A security researcher discovers an exposed Amazon S3 bucket containing over 50 gigabytes of files by viewing the source code of the Freedom Convoy's webpage. The exposed cloud storage contains over a thousand photos and scans of identity documents uploaded since February 4. These sensitive files are collected during the payment process because some financial institutions require identity verification before processing donations.
TechCrunch contacts GiveSendGo co-founder Jacob Wells with details of the exposed data, and the company secures the bucket a short time later. Wells does not respond to questions about whether the company plans to notify the affected individuals whose private information is left vulnerable. It remains unknown exactly how long the bucket sits exposed to the public internet before the platform takes action.