A massive unprotected database involving nearly 2.7 billion records from IoT grow light manufacturer Mars Hydro was discovered by vpnMentor cybersecurity researcher Jeremiah Fowler, exposing sensitive device and user information including Wi-Fi credentials and API details.
The unprotected database, totaling 1.17 TB in size, contained Wi-Fi network names, passwords, IP addresses, device IDs, and operating system information from Mars Hydro’s connected agricultural equipment. The exposure adds to mounting concerns about IoT device security, following several critical data breaches identified by security researchers in recent months.
Fowler, known for identifying major security vulnerabilities in other systems, promptly notified Mars Hydro and LG-LED SOLUTIONS through standard disclosure protocols. Though the database was secured within hours of notification, the duration of public accessibility and potential unauthorized access remain unclear.
The exposed data contradicts Mars Hydro’s privacy policy, which states their Mars Pro application “collects no user data.” The discovered logs showed extensive connectivity and credential details from users across multiple countries, including the United States, United Kingdom, and Australia.
Research from Palo Alto Networks indicates 57 percent of IoT devices are highly vulnerable, with 98 percent of transmitted data remaining unencrypted. This incident echoes previous security lapses, such as when Suprema had to improve its platform’s encryption after similar vulnerabilities were found.
Security professionals advise IoT manufacturers to strengthen data protection through encryption, hashed identifiers, and regular security audits. The breach raises particular concern given recent cyber threats, including a November 2024 incident where Russian hackers compromised Wi-Fi networks using “nearest neighbor attacks.”
“I publish my findings to raise awareness on issues of data security and privacy,” said Fowler, noting that his research encourages organizations to protect sensitive information proactively. This work supports industry standards for responsible disclosure and incident response.
Source: vpnMentor
—
February 26, 2025 – by Cass Kennedy
