[Breaches](/breaches) Public Relations: How a Marketing & PR Platform Exposed Thousands of Users [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Public Relations: How a Marketing & PR Platform Exposed Thousands of Users ##### [UpGuard Team](/team/upguard) Published Dec 09, 2019 ##### Join 27,000+ cybersecurity newsletter subscribers *Update: A MongoDB Inc. representative has stated that, "Mongolayer is part of a shuttered database service hosted by Compose IBM. This is a sunset 3rd party-service that was never owned or maintained in any way by MongoDB Inc."* The UpGuard Research team can now disclose that a data collection originating from iPR Software (risk score: 683) containing details of 477,000 media contacts, business entity account information, over 35,000 user password hashes, assorted documents, and administrative system credentials has been secured. The Amazon S3 storage bucket contained a large collection of files, some of which were configured for public access, totalling over a terabyte in size. In addition to the database files, the storage bucket contained documentation from iPR developers, documents which appear to be marketing materials for client companies, and credentials for iPR accounts on Google, Twitter, and a MongoDB hosting provider. As the makers of a software product for other companies to manage their digital marketing, the iPR user accounts in the exposed database have business emails for those client companies. Many of those clients are listed on iPR's website. UpGuard analysts confirmed that user accounts with hashed passwords were present for clients including GE, Xerox, CenturyLink, Forever21, Dunkin Donuts, Nasdaq, California Courts, and Mercury Public Affairs, a firm relevant to the Rick Gates and Paul Manafort investigations. In addition to the user accounts, the files stored in these clients' directories were also available.  ## Discovery and Notification On October 15, 2019 an UpGuard analyst detected an Amazon S3 storage bucket named "cms.ipressroom.com" configured for public access. After analysis confirmed the data was potentially sensitive, UpGuard notified iPR Software via email and phone on October 24th. During the phone call an iPR representative confirmed that the company’s CTO was aware of the notification and working to resolve the exposure. As UpGuard continued to monitor the bucket, the only observable change  was the appearance of a folder called “loganalysis.” After twelve days with no action, UpGuard contacted trusted journalists at Scoop News Group, with whom we have worked in the past, for additional help engaging iPR. Finally, public access for the bucket and all contents was removed on November 26, 2019. ## Significance This storage bucket contained a vast collection of files, potentially serving as the backend for the content management system that iPR licensed to customers. Internal documentation for iPR's development teams, located in Los Angeles, US, and Kaluga, the Russian Federation according to Crunchbase, described how iPR developers could administer the platform to help client companies manage their digital marketing. The contents of the bucket thus included both iPR's internal resources for managing their platform and its user accounts, and client documents that were distributed through iPR's CMS product. Multiple overall size queries through AWS timed out after tallying over a terabyte of downloadable files. One folder contained backups generated from MongoDB databases, with the most recent and largest publicly accessible backup being a 17 GB file from 2017 which, when loaded into a MongoDB instance, expanded to over 100 gigabytes in size. A table of user data contained a total of 477,000 email addresses, with hashed passwords present for approximately 35,000 of these profiles. The distinction between users with and without passwords is not clear from the available data but those with passwords presumably had accounts they could log into, while those without may just have been contacts for media outreach. The bucket also contained directories with files relevant to their clients. These directories contained mostly marketing assets, many of which would be intended for public consumption, but also internal public relations strategy documents like plans for communications during crises or adverse media attention.\ \ Finally, this data exposure highlights the potential for secondary data loss in exposing credentials for other systems. Among the credentials were the keys for iPR's Twitter account, a password for a MongoDB hosted on mongolayer.com, and a Google API access key. As always, UpGuard researchers do not attempt to use discovered credentials, and so the access level provided by these is uncertain. However, the consequences of compromised credentials to social media accounts are well known and can result in blatant defacement or surreptitious private messaging. ### Conclusion Almost all of the modern internet is supported by marketing in one form or another. While [digital advertising](https://thecorrespondent.com/100/the-new-dot-com-bubble-is-here-its-called-online-advertising/13228924500-22d5fd24) is the core revenue stream for platforms like Google, Facebook, and Twitter, businesses use their online presence to market to customers by distributing information about their products and gathering contact information from potential customers. As a large PR and marketing provider, iPR would generate and manage a centralized collection of that kind of data for their clients. When made public, the result is the exposure of information for hundreds of thousands of people attached to or targeted by PR and marketing efforts. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)