World Baseball Softball Confederation exposed 4,600 passport scans in open AWS bucket

The World Baseball Softball Confederation, the Switzerland-based governing body for baseball, softball and Baseball5, left an Amazon Web Services storage bucket open to the public internet. Researchers at Cybernews found the misconfigured bucket on June 5, 2023 and said it held close to 48,000 files.

Among those files were scanned copies of roughly 4,600 national passports. Passport images carry full names, dates of birth and unique document numbers, which the researchers said could be used for identity theft, opening accounts or applying for credit in a victim's name, producing counterfeit travel documents, or building convincing spear phishing approaches.

The WBSC closed the bucket after the research team contacted it. The organization did not respond to requests for comment before the findings were published on September 28, 2023, and it issued no public statement about the exposure.

No evidence was made public that anyone other than the researchers retrieved the files, and neither the researchers nor the confederation said whether access logs had been reviewed to establish that. Cybernews recommended a retrospective log review and notification of data protection authorities if the bucket turned out to have been accessed. The WBSC was established in 2013 and has member federations in 141 countries across Asia, Africa, the Americas, Europe and Oceania.