Site icon The Cybersecurity Daily News

Data breach at global cosmetic brand “Avon” leading to a major cybersecurity vulnerability


A world-renowned brand in cosmetics Avon has reported a critical breach in their data found on their web server. This was exposed publicly without any encryption or password protection. 

The discovered vulnerability is found operative to anyone who possesses the IP-address of the server. They can access and furthermore even manipulate the organization’s data. 

In an assertion to the market on the 9th of June 2020, Avon put out an explanation affirming that an episode had “intruded on certain systems and halfway influenced the operations as well”; demonstrating that the assertion or statement was referring to an alternate issue that may, or may not be identified with the penetration detected. 

A couple of days after the fact, Avon presented a second administrative recording pronouncing that no money related information was included “as its fundamental online business site doesn’t store that data”. The organization has additionally affirmed that its multiple online functions keep in different phases of recuperation or recovery, with certain areas working regularly, while others are still disconnected.

What and who are

Founded in the year 1886, the site’s parent organization, New Avon Company, is a main social selling beauty organization working in North America, Puerto Rico and Canada. In any case, the organization has its headquarters in London, UK.

Avon’s item portfolio incorporates some award-winning skincare, shading makeup, scents and personal care items, like accessories and style items.

Also read,

In May 2019, Brazilian organization Natura and Co. reported its goal to secure a 76% stake in Avon with the final deal signed up in January 2020. Fortuitously, Natura and Co. were entangled in its own disaster of cybersecurity in April this year. 

The exchange made the world’s fourth-biggest “unadulterated play” beauty organization, that expects to court a huge number of clients around the world.

What data was leaked exactly?

The server of’s contained API logs for the organization’s web and mobile sites which implied the information break uncovered all creation server data including the internal “OAuth tokens”. 

Like the access tokens, OAuth tokens are utilized for sign-in purposes, with the key contrast being that they terminate or expire after a restricted period of time. Hence, clients must create new tokens to acquire another OAuth token. On account of’s vulnerability of the server, both the sign-in and new tokens were uncovered, which is adequate or more than enough for malevolent attackers to gain an account’s full access.

Additionally, Avon’s server likewise contained the inward logs that could be repurposed by malicious users to hamper or abuse Avon’s IT system. Programmers might saddle the server to plant any malware, mine cryptographic money, or lead any ransomware assaults upon the proprietors or owners of the server. 

In any case, it is critical to take note of that, at this stage, it stays indistinct whether Avon’s vulnerability of the server and its broad operational issues as of late is associated in any manner. 

The below-mentioned information was identifiable from’s server: 

The server also contained non-personal technical information such as:

Data Breach Impact’s server hack represents a few possible risks to the clients who are influenced.

On the whole, uncovered subtleties might be utilized to direct identity fraud and theft across various stages and platforms. Clients’ contact information could be saddled to lead a wide range of tricks and scams while individual data from the leak could be exploited to energize click-throughs and malware downloads. Individual data is likewise misused by hackers to gain compatibility and trust, with a drawn-out perspective of carrying out bigger scale hacks and intrusions in the future.

Disturbingly, the release uncovered reams of specialized technical logs which could be misemployed to target Avon clients as well as Avon’s IT infrastructure legitimately, consequently prompting further security vulnerabilities and budgetary consequences.

Given the sort and magnitude of delicate data made accessible, hackers would be able to organize full server control and lead extremely harmful activities that permanently defile the Avon brand; in particular, ransomware assaults and deadening the organization’s payments framework.

Preventing Data Exposure

How might you keep your own data from being uncovered in an information spill and guarantee that you are not a casualty of assaults – in the digital or genuine world?

But the question remains – what if your information gets spilled? 

The above mentioned are some of the methods tried and tested by the experts of SecureLayer7. Following these steps or taking the required measures should do the trick to prevent foreign breaches within the systems. 

Exit mobile version