U.S. Internet Leaked Years of Internal, Customer Emails – Krebs on Security

I was shocked to see a headline from Krebs that referenced my own ISP - U.S. Internet!

The Minnesota-based Internet provider U.S. Internet Corp. has a business unit called Securence, which specializes in providing filtered, secure email services to businesses, educational institutions and government agencies worldwide. But until it was notified last week, U.S. Internet was publishing more than a decade’s worth of its internal email — and that of thousands of Securence clients — in plain text out on the Internet and just a click away for anyone with a Web browser.

The writeup and screenshots are shocking. The response from U.S. Internet was also not impressive.

KrebsOnSecurity has been writing about data breaches for nearly two decades, but this one easily takes the cake in terms of the level of incompetence needed to make such a huge mistake unnoticed. I’m not sure what the proper response from authorities or regulators should be to this incident, but it’s clear that U.S. Internet should not be allowed to manage anyone’s email unless and until it can demonstrate more transparency, and prove that it has radically revamped its security.

I use USI for fiber internet and the service is fabulous. I have a great 1 gigabit connection that is rock solid. I don't use them for anything else, and would have preferred there engagement on this incident was more robust.