JailCore Company Profile
JailCore is a correctional facility management and compliance cloud-based application, evidently started by the same people behind the insurance consultancy Correctional Risk Services, Inc. Its official parent company is CRS Technologies, LLC, and JailCore is listed as being based in Brentwood, Tennessee, and founded in 2017. For a technology company, our research team found it odd that there was no available privacy policy nor terms of service for JailCore, and their site is being served unencrypted without a SSL certificate.
Timeline of Discovery and Owner Reaction
Sometimes the extent of a data breach and the owner of the data are obvious, and the issue quickly resolved. But rare are these times. Most often, we need days of investigation before we understand what’s at stake or who’s leaking the data. Understanding a breach and its potential impact takes careful attention and time. We work hard to publish accurate and trustworthy reports, ensuring everybody who reads them understands their seriousness. Some affected parties deny the facts, disregarding our research or playing down its impact. So, we need to be thorough and make sure everything we find is correct and true. Date discovered: January 3, 2020 Date company notified: January 5, 2020 Date the Pentagon was notified: January 15, 2020 Date bucket was closed: between January 15 and January 16, 2020 Our team reached out initially to Jailcore directly. They refused to accept the disclosure of our findings. We then reached out to The Pentagon to bring this leak to their attention, and the S3 Bucket leak was subsequently closed.
Examples of Entries in the Database
In an attempt - according to their marketing - for Jailcore to help ensure better compliance with insurance standards by creating their app, their plans have backfired. They have created more of a risk and additional threats to the well-being of those at the nerve-end of the system. Each detainee that was checked into a detention center, from what we could see, has a number of PII about themselves and their mugshots logged into the system. A portion of this is shared in an online, publicly-accessible roster of current inmates when it comes to county jails, for example. What’s not meant to be available to all is individual specific medication information and additional sensitive data. Also included were the full names of correctional officers (and occasionally their signature), associated with personally-filled out observation reports and the like.
It’s important to note that a portion of the entries were of ‘dummy-data,’ but we were still able to find a sizable amount of actual user-end data as well. Here’s the list of data that our research team found and was able to identify:
Data Impacted
Prescription records for inmates (PHI) Medicine name Dosage amount Start and end date Prescription quantity & refills remaining Time/date administered Full name of correctional officer who administered (and, in some cases, their signature) If the inmate took the prescription or refused PII of inmates Full name Booking number Date of birth Cell location Mugshot Headcount report Date Name of inmate Inmate ID Inmate date of birth Inmate cell location (including ‘detox’ facilities) Officer Audit Log Type of observation (eg: isolation, cell, head count) Date/time of observation Which inmate and/or cell observed Inmate activity (time meal served, time returned to cell, etc.) Inmate Mugshots Inmate Activities Report Restroom Shower Meals Return to cell Visits Recreation Packages Cleaning
States Affected
These are the states where we found detention centers included in the leak, but we did not open each file and it is possible that there are more correctional facilities in additional states that were impacted.
Florida Kentucky Missouri Tennessee West Virginia
Data Breach Impact
This leak represents a potentially severe threat to those whose data has been exposed. It has many implications, all of which could very well ruin the lives of those involved. For many of the app’s customers, there is a current inmate roster on their Detention Center’s website. However, this roster does not include their medicine, their behavior, and their punishments - all of which were potentially made available in this data leak.
Identity Theft
Knowing the full name, birthdate, and, yes, even the incarceration record of an individual can provide criminals with enough information to steal that person’s identity. Considering that the person whose identity is stolen is in jail, cut off from normal access to a cellphone or their email, the damage could be even greater, as it will take longer to discover. Identity theft does not always mean that the thief will claim that they are a particular individual in real life; it also allows them to engage in credit fraud, drain your bank account, and engage in scams to family, friends, and other associates of the identity theft victim.
Advice from the Experts
Jailcore could have easily avoided this leak if they had taken some basic security measures to protect the S3 Bucket. These include, but are not limited to: Any company can replicate the same steps, no matter its size. For a more in-depth guide on how to protect your business, check out our guide to securing your website and online database from hackers.
For Inmates and Correctional Officers Everywhere
You can contact Jailcore directly and find out how they are resolving this issue and plan on protecting your data better in the future. Whether you’re an inmate or correctional officer who may have your personal information on the Jailcore platform - and are concerned about how this breach might impact you or other data vulnerabilities in general, read our complete guide to online privacy to help better protect yourself online in the future. It shows you the many ways cyber criminals target internet users, and the steps you can take to stay safe. You can also use a VPN to hide some of the data collected by Jailcore. A VPN will mask your IP address and country of residence, giving you an added layer of protection even if your data is leaked. For anyone working in the correctional industry, it is imperative that you take it upon yourself, going above and beyond in safeguarding your personally identifying information.
How and Why We Discovered the Breach
The vpnMentor research team discovered the breach in Jailcore’s database as part of a huge web mapping project. Our researchers use port scanning to examine particular IP blocks and test open holes in systems for weaknesses. They examine each hole for data being leaked. When they find a data breach, they use expert techniques to verify the database’s identity. We then alert the company to the breach. If possible, we will also alert those affected by the breach. We were able to access Jailcore’s S3 bucket because it was completely unsecured and unencrypted. Using a web browser, the team could access all files hosted on the database. The purpose of this web mapping project is to help make the internet safer for all users. As ethical hackers, we’re obliged to inform a company when we discover flaws in their online security. However, these ethics also mean we also carry a responsibility to the public. This is especially true when the companies data breach contains such a huge amount of private and sensitive information.
About Us and Previous Reports
vpnMentor is the world’s largest VPN review website. Our research lab is a pro bono service that strives to help the online community defend itself against cyber threats while educating organizations on protecting their users’ data. In the past, we’ve discovered a breach in LightInTheBox that compromised the data of its customers. We also recently revealed that a company owned by major hotel chain AccorHotels exposed over 1TB of guests’ data. You may also want to read our VPN Leak Report and Data Privacy Stats Report. JailCore Comment: “1. We are a startup company that currently works with 6 jails totaling 1,200 inmates. Not the 36,000 mentioned in an earlier email. 2. Of those 6 jails, only 1 is using the application to track medication compliance is a 35 inmate jail and only 5 of those 35 inmates in that jail has a prescribed medication. Meaning all other reports with any mention of medication were all used for demonstration purposes only. 3. These are incarcerated individuals, not free citizens. Meaning, the same privacy laws that you and I enjoy, they do not. I would implore you to get all facts straight before writing/publishing anything. You cannot look at this like an example of a private citizen getting certain private information hacked from the cloud. These are incarcerated individuals who are PROPERTY OF THE COUNTY (this is even printed on their uniforms)….they don’t enjoy our same liberties. Having said all of this, the safety and security of all our data, whether at rest, in transit or in a report are extremely important to us. We have rectified the situation of the data held within a report. Below is a description of how our data at rest and in transit is secured: Data Security is of utmost importance here at JailCore. We ensure all of our data is encrypted end to end as well as when it is at rest. Here are a few things we use to ensure the security of our client’s data: SSL We use a SHA-256 SSL Certificate to protect all data while in transit to our server. That means all the data being sent to our servers is encrypted while in transit and if intercepted by a hacker they would only see a garbled mess. The digital security industry now recommends SHA-256 as the standard signature hash algorithm for SSL certificates. The signature hash algorithm generates a digital fingerprint - also known as a “hash”, “digest”, or “checksum” - of information transferred during an SSL session. This fingerprint verifies that the information was not tampered with or corrupted between the server and client. The data we request from a facilities JMS is also encrypted using SSL even though we do not ask for any information from a JMS that isn’t already public information. Google Cloud SQL All of our data is stored in the Google Cloud Platform which uses several layers of encryption to protect customer data at rest. Data for storage is split into chunks, and each chunk is encrypted with a unique data encryption key. These data encryption keys are stored with the data, encrypted with key encryption keys that are exclusively stored and used inside Google’s central Key Management Service. The data is encrypted when stored in database tables, temporary files, and backups. Data stored in Google Cloud Platform is encrypted at the storage level using either AES256 or AES128.”
