Lionsgate streaming platform leaks data of 37 million users

Video streaming platform Lionsgate Play exposed sensitive data on millions of its users, cybersecurity researchers from Cybernews found.

The website’s team found (opens in new tab) Lionsgate’s platform kept an unprotected ElasticSearch instance, containing 20GB of server logs with roughly 30 million entries. Some of the data dates back to May 2022, and included user IP addresses as well as information on user devices, operating systems, and web browsers. 

While this is not exactly personally identifiable information (opens in new tab), it can still be used by threat actors to conduct intrusions, the researchers said.

Possible authentication secrets

“It can be useful in targeted attacks, especially when combined with other leaked or publicly available information,” Cybernews’ team said in its report.

By knowing the IP addresses, the attackers can deliver custom-built malicious payloads to the targets, they added.

But this is not the only data that was leaked via ElasticSearch. Usage data, such as content titles, IDs, and search queries, were also leaked. This data is usually used by analysts to track the platform’s and content’s performance. Furthermore, researchers discovered unidentified hashes with logged HTTP GET requests, which are user-made requests for data, stored on the server.

While the researchers couldn’t say what the hashes are used for, they did say they contain more than 156 characters, meaning they were supposed to stay unchanged for long. 

“Hashes didn’t match any commonly used hashing algorithms. Since these hashes were included in the HTTP requests, we believe they could have been used as secrets for authentication, or just user IDs,” said researchers.

When reached out to by the researchers, Lionsgate responded by closing the open instance. However, an official statement is yet to be made. 

Streaming platforms are popular targets among cybercriminals. Before Lionsgate Play, hackers managed to breach Plex, START, and Carbon TV.

• Check out the best password managers (opens in new tab) right now

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.