If you’re looking for a quick and easy way to turn a file into a PDF, there are countless sites on the internet that can complete the process for free in seconds. Of course, users have no control over what the sites do with the documents they upload. That becomes a serious problem if, say, two online PDF converters start leaking their data.
Unfortunately, that’s exactly what happened, as the Cybernews research team found two online PDF converters with exposed Amazon S3 cloud storage buckets leaking passports, certificates, IDs, contracts, and more that users have uploaded to their sites.
According to Cybernews, PDF Pro (pdf-pro.io) and Help PDF (help-pdf.com) — which have the same design and are seemingly run by the same UK-based company — have left cloud storage containers open to anyone. As of Thursday, there are 89,062 exposed files — 87,818 uploaded to PDF Pro and 1,244 uploaded to Help PDF.
Cybernews researchers shared this statement: “With access to personal documents, criminals can engage in various fraudulent activities such as applying for loans, renting properties, or purchasing expensive items using the victim’s identity.”
It gets worse, as Cybernews claims that the data is still exposed. The researchers team reached out to the service providers, but have yet to hear back. If you upload a file to either site right now, it will be accessible to anyone who goes looking for it.
Even if you have never used these PDF converters, let this be a warning. Before you upload a private document to a random website, remember that you don’t know how that site handles its data. Take a few extra minutes to find a reliable service.
