Drones-selling website ‘left details of police and army customers online’

A website selling drones left its customer details online, revealing purchases of its products by the police, army and parts of the government, according to reports.

Tech website The Register says the DronesForLess.co.uk website was left “wide open”, allowing it to discover 10,000 online purchase details, revealing names, addresses, email addresses and other information. The details were first uncovered by the security website secret-bases.co.uk.

Infosec researcher Scott Helme told The Register: “From a technical perspective, having this kind of information in a publicly accessible directory is incredibly negligent.

“This information should be stored in a database and most certainly should not be available to the internet and stored in plain text.” There was no response to a phone call or an email seeking comment from DronesForLess.

The Government said: “We treat the security of our information very seriously. We have asked the company involved to remove any public record of this data and to let all those affected know.” Military and police staff bought various drones, including a DJI Phantom 3 quadcopter. It is not clear if they were for personal or professional use.

Some credit card details were also reportedly exposed.