15-09-26, 11:56 PM
Access to the OWA Global Address List (GAL) was successfully obtained through credentials protected by insufficient security controls, allowing the enumeration of 6,718 unique records belonging to employees of Mexico City’s Administration and Finance department.
The collected information included names, email addresses, and other identifiers available in the directory. This exposure enables the identification of valid accounts, organizational structure, and potential targets, increasing the risk of targeted attacks, phishing, social engineering and other subsequent account-compromise attempts.
