Is it a bird? Is it a plane? No, it's a terrible leak of drone buyers' data

Exclusive A popular drone dealership website left its entire transaction database exposed online with no encryption at all, revealing a host of purchases by thousands of police, military, government and private customers.

The DronesForLess.co.uk site was left wide open by its operators, who failed to protect critical parts of its web infrastructure from curious people, as spotted by Alan at secret-bases.co.uk, who told The Register.

We discovered more than 10,000 online purchase receipts had been saved to its web servers without any encryption or even password protection whatsoever – and the sensitive customer details in those receipts were exceptionally easy to access. Even your grandparents could have found it using Internet Explorer.

Details available for world+dog to browse through included names, addresses, phone numbers, email addresses, IP addresses, devices used to connect to the site, details of ordered items, the card issuer (e.g. Visa) and the last 4 digits of credit cards used to pay for goods.

Orders placed by police and military personnel included:

• A purchase of a DJI Phantom 3 quadcopter by a serving Metropolitan Police officer, delivered to the force's Empress State Building HQ in London, and made with a non-police email address composed of his unit's very distinctive abbreviation
• A British Army Reserve major who had an £1,100 drone posted to his unit's HQ
• A member of the Ministry of Defence's procurement division who bought a DJI Inspire 2, complete with spare battery and accidental damage insurance
• A member of the National Crime Agency, who appeared to have used his ***@nca.x.gsi.gov.uk secure email address to buy a Nikon Coolpix digital camera

It was unclear whether these purchases were for personal or governmental use.

Other orders seen by The Reg include ones placed by: staff from privatised defence research firm Qinetiq; the UK's Defence Science and Technology Laboratory's radar R&D base at Portsdown Hill; the Brit Army's Infantry Trials and Development Unit; UK police forces up and down the country; local councils; governmental agencies; and thousands more orders placed by private individuals.

Many were for cameras and other optical gear as well as drones, reflecting the network of branded e-commerce sites that Drones For Less forms a part of.

Infosec researcher Scott Helme told us: "From a technical perspective having this kind of information in a publicly accessible directory is incredibly negligent. This information should be stored in a database and most certainly should not be available to the internet and stored in plain text!

"At a minimum the company involved need to contact all of the affected customers and inform them what data has been leaked so that they can take whatever steps they deem necessary, even if that’s just so they can be vigilant for potential phishing emails. I hope that the ICO will also take action against the company for such a negligent leak of personal information."

About that UK web address...

Drones For Less gives a London Mailboxes ETC shop (effectively a PO box number) as its postal address, and an 0203 SIP number – which can be configured to forward calls anywhere in the world – as a contact telephone number.

We first called it to report the breach to the site's operators on 2 April. After being invited to hold by a cheery North American-accented auto-answer message, we got through to a customer support rep who introduced himself as John. He also had a distinctly North American accent. John asked us to email him details of the breach. We did this and asked repeatedly for a statement from the firm, to no avail.

Repeated followup phonecalls resulted in John sending us the email addresses of others within Drones For Less, inviting us to ask them for a comment, which we have done.

The dronesforless.co.uk domain name is registered to a company calling itself Mapleleafphoto LLC. The address – 2 Toronto Street, Toronto, Canada, as a Nominet Whois lookup shows – is a UPS shop, so is effectively another anonymous PO Box forwarding address.

A superficially similar website called Mapleleafphoto.ca gives a Quebec contact address which appears to lead to an industrial unit in that city.

The Drones For Less operator appeared, earlier this week, to be playing whack-a-mole with individual links to samples of the breached data we sent to him, taking those down but not others. Following sustained pressure, it now appears, to the best of El Reg's ability to confirm, that the data has been removed from public view.

Drones For Less appears to be closely related to Cameras For Less, Video For Less and Tablets For Less, judging by house adverts on its Contact Us page.

A spokeswoman for the British government sent us a statement:

We treat the security of our information very seriously. We have asked the company involved to remove any public record of this data and to let all those affected know.

The UK Information Commissioner's Office and Canada's Office of the Privacy Commissioner are both aware of the breach. ®