The exposed data was found by UpGuard's security lead Chris Vickery on 6 July when he found an open port configured to accept packets at an IP address. Vickery heads the company's Cyber Risk Team.
When this was entered into a command-line interface, a fully downloadable data repository from PQE came down the pipe.
"Among the data that was exposed was the contents of one folder, Dell folder 6807, with a document labelled 'Director of Central Intelligence Directive No. 6/9' serving as a startling indicator of how sensitive the data entrusted to third-party vendors can be," UpGuard said in a blog post.
Such facilities are secure rooms used by security-cleared individuals to receive sensitive information. "Constructed with the specific goal of making external surveillance, eavesdropping, or interception of any information in the room as difficult as possible, SCIFs are common to intelligence community facilities and military installations," UpGuard said, adding that the location of such a secure room at a Dell facility in central Texas was clearly delineated.
The size of the repository is unknown but Vickery had downloaded about 205GB by the time PQE secured its systems on 8 July after being notified of the exposure by UpGuard.
The security firm pointed out that PQE had a poor CSTAR external cyber risk score of 181 out of a possible 950 at the time the data exposure was found.
"Beyond this highlighting of potential weak points and trouble spots in customer electrical systems, publicly downloadable schematics reveal the specific locations and configurations of government-operated top secret intelligence transmission zones within at least one Dell facility," UpGuard said in a statement.
"In addition to this exposed customer data, a plain text file of internal PQE passwords was also stored in the repository, potentially enabling further access to more company systems."
The port that was exposed, 873, is used by the tool rsync, developed by Australian developer Andrew Tridgell, that is used for easy and rapid copying of data to another machine.
UpGuard said the configuration of PQE’s rsync process to allow public access through an open port was very common in IT environments. "While IT personnel can restrict port access to only authorised PQE employees, such measures can easily be forgotten without processes in place to ensure security gaps are identified and closed immediately," the company said.
"While the IP addresses able to access these systems via this port can be easily restricted by IT administrators using rsync’s 'hosts allow/deny' functions, this requires an extra step once the rsync utility is configured. This default accessibility, while simple to restrict, can be missed."
The repository included folders labelled Clients, User, and Intuit. Within the Clients folder, there were sub-folders with the names of many well-known companies.
"This data consists of reports and infrared imagery of weaknesses in clients’ power infrastructures as discovered and evaluated by PQE inspectors," UpGuard said. "Such infrared studies and their associated reporting reveal, with high levels of specificity, energy infrastructure inspection results of clients like HealthSouth Rehabilitation Hospital of Austin."