Security & Fraud

Garmin Shipping Navigation Unit Suffers Breach


Navionics, an Italian company that manufactures electronic navigational charts for boating, was the victim of customer data breach that exposed hundreds of thousands of customer records.

Bob Diachenko,’s director of cyber risk research, revealed in a blog post that the company’s MongoDB database wasn’t secured with password protection, which meant anyone could access and download its data.

Navionics, which was recently acquired by tech giant Garmin, offers boat, yacht and ship owners access to real-time navigation charts through the “world’s largest cartography database.”

The 19 gigabyte database contained more than 260,000 records, including customer names and email addresses. In addition, it provided information about their boat — latitude and longitude, boat speed and other navigational details — which Diachenko said was likely updating in real-time.

Once discovering the breach, Diachenko contacted the company and Navionics immediately shut down the server.

“Navionics takes data protection very seriously, and we are grateful that Mr. Diachenko notified us of this misconfiguration using the responsible disclosure model,” the company said in a statement. “Once notified, we immediately investigated and resolved the vulnerability. Following our investigation, we confirmed that none of the records or data were otherwise accessed or exfiltrated, and none of the data was lost. Even so, Navionics still notified affected customers via e-mail by October 8, 2018.”

As one of the most widely used database providers in the world, many exposed MongoDB databases have been accessed by hackers, according to reports.

“The main takeaway from this is the importance of security at every stage of your development process,” wrote Diachenko. “It should not even be argued that your development network must be one of your most secure networks, for it contains your intellectual property.  As we learned from this incident, one never knows when transient firewall rules may inadvertently expose your development machines to the public. In this case, it appears to have only exposed some pieces of personal information, but for others, it could be critical intellectual property or even your entire subscriber base that could be exposed.”


Featured PYMNTS Study:

More than 63 percent of merchant service providers (MSPs) want to overhaul their core payment processing systems so they can up their value-added services (VAS) game. It’s tough, though, since many of these systems date back to the pre-digital era. In the January 2020 Optimizing Merchant Services Playbook, PYMNTS unpacks what 200 MSPs say is key to delivering the VAS agenda that is critical to their success.